Is marcosrippel/whatsapp-utils safe?

The export-contacts command reads contacts.json from the WhatsApp session credentials directory and outputs every contact's phone number, display name, and business status as structured JSON. This is a complete contact list exfiltration capability. The agent receives this data in its context, from which any network-capable co-skill or user instruction can forward it externally. No user consent prompt, scope limit, or output sanitization is implemented.

The cache-info command performs a full directory listing of the WhatsApp credentials path, categorizes files by type (creds.json, contacts.json, store.json, session-, sender-key-, device-list-*), and reports aggregate sizes. This provides an attacker with a complete inventory of credential assets available for further extraction.

The skill produces structured, machine-readable contact PII output (JSON array of {phone, name, isBusiness}) directly in agent context. An attacker controlling user prompts needs only one additional instruction to an agent with HTTP capabilities to exfiltrate the entire WhatsApp contact list. The attack vector requires no code modification — the skill is the exfiltration primitive and the agent's existing tools are the delivery mechanism.

Six canary files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, gcloud ADC) were opened and read at two points during the audit. Timing analysis correlates both access batches with monitoring infrastructure sudo invocations rather than skill script execution, and the integrity check reports no file modification. However, the monitoring system cannot distinguish read-based exfiltration, and process-level attribution was not definitively confirmed for all access events.

The format and clean commands concatenate all argv tokens after position 2 with join(' ') and pass the result to handler functions. While the handlers only apply regex operations (replace(/\D/g, '')), the pattern establishes unsanitized user-input-to-code-argument flow. A sufficiently adversarial phone number string passed by a compromised agent could exploit edge cases in Node.js argument parsing.

SKILL.md instructs the agent to construct exec() calls with phone number arguments interpolated from user input. If the hosting agent does not properly quote arguments before shell execution, a malicious phone number string could inject additional shell commands. This is a documentation-level concern rather than a code vulnerability, but it establishes a risky precedent.

The entire installation process consists of a single git sparse-checkout clone from github.com/openclaw/skills.git. No secondary downloads, npm installs, or remote script fetches were detected. The connection to GitHub closed cleanly after file copy.