WhatsApp Utils

Phone number formatting, cache inspection, contact export, and message ID generation

This skill appears to do what it claims, but note three practical issues before installing: (1) SKILL.md runs a local Node script — you must have the `node` binary available even though the registry metadata lists no required binaries; (2) the script reads your OpenClaw WhatsApp state directory (default ~/.openclaw/credentials/whatsapp/default or overridden by OPENCLAW_STATE_DIR) and will parse contacts.json and other cache files — those contain personal data you may not want exported; (3) the metadata does not disclose use of OPENCLAW_STATE_DIR. The skill does not make network calls, but it will print local contact data and cache statistics to stdout. If you plan to use it, inspect scripts/utils.js yourself, ensure you trust the author, consider running it in a controlled environment (or on a copy of your WhatsApp state), and verify Node is present. If you need stronger assurances, ask the author to: declare the node binary and OPENCLAW_STATE_DIR in metadata, and explicitly document which local files are read and what data is printed.

Type: OpenClaw Skill Name: whatsapp-utils Version: 1.0.0 The skill is classified as suspicious due to its direct access and output of potentially sensitive data from the OpenClaw state directory. Specifically, `scripts/utils.js` reads the content of `contacts.json` and lists files (including credential-related ones like `creds.json`, `session-`, `sender-key-`) from the `OPENCLAW_STATE_DIR/credentials/whatsapp/default` path. While the `SKILL.md` description mentions 'cache inspection' and 'contact export', these capabilities, even if intended, represent a significant information disclosure risk if the agent is compromised or misused, as the data is outputted to `console.log`.