Security audit
Security checks for vulnerabilities and agentic risk
Overview
This is a WhatsApp channel plugin whose sensitive WhatsApp access is disclosed, purpose-aligned, and guarded by user configuration.
Install this only if you want OpenClaw to link to a WhatsApp Web account and potentially read configured chats, send replies, handle approvals, and store WhatsApp session credentials. Prefer a dedicated WhatsApp number, keep dmPolicy/groupPolicy/allowFrom restrictive, and enable optional wacli history sync or message_received plugin hooks only when you trust the receiving tools/plugins.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.