WhatsApp OpenAPI Skill

Operate WhatsApp Business Platform Cloud API through UXC with a curated OpenAPI schema, bearer-token auth, and message/profile guardrails.

This skill appears to do what it says (wrap the WhatsApp Cloud API via uxc), but there are a few things to check before installing: 1) The SKILL.md expects you to configure a bearer token in WHATSAPP_CLOUD_ACCESS_TOKEN, but the registry metadata does not declare any required environment variables — confirm you will provide only a least-privilege token and that the omission was accidental. 2) The skill fetches a curated OpenAPI schema from raw.githubusercontent.com and makes requests to graph.facebook.com — if you need to audit network interactions or pin the schema, download and review the JSON locally before use. 3) Ensure the token you provide has limited scope and rotation policies (avoid using long-lived/full-admin tokens). 4) The skill instructs explicit confirmation before sends — verify your agent or human workflow enforces that to avoid accidental outbound messages. If the owner or source is unknown, prefer to review the schema and the validate.sh locally and to test with a non-production token/account first.

Type: OpenClaw Skill Name: whatsapp-openapi-skill Version: 1.0.0 The WhatsApp Cloud API skill bundle is well-structured and aligns with its stated purpose of managing WhatsApp Business Platform operations via the uxc tool. It includes a curated OpenAPI schema (whatsapp-cloud.openapi.json), clear authentication procedures using environment variables, and explicit safety guardrails in SKILL.md that require user confirmation for high-risk write operations. No evidence of malicious intent, data exfiltration, or unauthorized command execution was found.