💬 WhatsApp Business API — 商务消息接口
v1.0.0集成 WhatsApp Business Cloud API，实现消息、模板、媒体、Webhook、流程与商业档案的一站式管理。
0· 650·0 当前·0 累计
by 下载技能包
最后更新
2026/2/26
安全扫描
OpenClaw
可疑
medium confidenceThe skill's documentation and examples match a WhatsApp Business Cloud integration, but the runtime instructions reference additional sensitive environment variables and local storage that are not declared in the registry metadata — this mismatch deserves clarification before installing.
评估建议
This package appears to be a genuine WhatsApp Business Cloud API guide, but there are a few important mismatches to resolve before you install:
- Confirm required credentials: The registry lists WHATSAPP_ACCESS_TOKEN and WHATSAPP_PHONE_NUMBER_ID, but the runtime docs also reference WHATSAPP_BUSINESS_ACCOUNT_ID and WHATSAPP_APP_SECRET (used for template operations and webhook signature verification). Ask the publisher or maintainer which env vars the platform will actually request and include th...详细分析 ▾
ℹ 用途与能力
The name/description and all curl examples target Meta's WhatsApp Business Cloud API and the required WHATSAPP_ACCESS_TOKEN and WHATSAPP_PHONE_NUMBER_ID are appropriate. The skill's declared purpose aligns with the operations described (messages, templates, media, webhooks, flows, business profiles).
⚠ 指令范围
SKILL.md and the auxiliary files instruct the agent to use additional environment variables (WHATSAPP_BUSINESS_ACCOUNT_ID and WHATSAPP_APP_SECRET), create and update a local memory file at ~/whatsapp-business-api/memory.md, and handle webhook verification. The registry metadata only declared two env variables (WHATSAPP_ACCESS_TOKEN and WHATSAPP_PHONE_NUMBER_ID) but the instructions use more — that's an incoherence because runtime behavior requires secrets not declared up front.
✓ 安装机制
This is an instruction-only skill with no install spec and no bundled code, so nothing will be downloaded or written by an installer. That minimizes supply-chain risk.
⚠ 凭证需求
The declared primary credential (WHATSAPP_ACCESS_TOKEN) is appropriate. However, the documentation expects WHATSAPP_BUSINESS_ACCOUNT_ID and WHATSAPP_APP_SECRET (sensitive) for template management and webhook verification but these are not listed in requires.env. The missing declarations make it unclear what the platform will provide or request and whether those additional secrets would be exposed to the skill.
ℹ 持久化与权限
The skill stores preferences and memory under ~/whatsapp-business-api/memory.md (user home). Writing user-scoped files is expected for a conversational/integration helper and is not privileged, but anything stored there (phone numbers, webhook URLs, template names) could leak sensitive configuration if misused. The skill is not set to always:true and does not request system-wide changes.
安全有层次，运行前请审查代码。
运行时依赖
🖥️ OSLinux · macOS · Windows
版本
latestv1.0.02026/2/25
Initial release with full Cloud API coverage.
● 无害
安装命令
点击复制官方npx clawhub@latest install whatsapp-business-api
镜像加速npx clawhub@latest install whatsapp-business-api --registry https://cn.longxiaskill.com