by 安全扫描
OpenClaw
可疑
high confidenceThe skill's instructions are coherent with a WhatsApp Cloud API reference, but the metadata claims no required environment variables while the runtime examples clearly depend on secret tokens and IDs — an important mismatch that should be fixed before trusting it.
评估建议
This appears to be a legitimate WhatsApp Cloud API reference, but the registry metadata is missing required environment variables that the examples clearly use. Before installing or enabling this skill:
- Treat the examples as requiring secrets: WA_ACCESS_TOKEN (access token), WA_PHONE_NUMBER_ID (phone number id), and VERIFY_TOKEN (webhook verification token). Ask the author to declare these explicitly in requires.env/primaryEnv.
- Do not paste real access tokens into public or shared prompts...详细分析 ▾
⚠ 用途与能力
The name/description match the SKILL.md content (examples for sending messages, templates, media, and webhooks). However the registry metadata says 'Required env vars: none' and 'Primary credential: none' even though the examples rely on secrets/IDs (e.g., WA_ACCESS_TOKEN, WA_PHONE_NUMBER_ID, VERIFY_TOKEN). That omission is incoherent and downplays the need for sensitive credentials.
✓ 指令范围
The instructions and code samples stay inside the stated purpose (sending messages, templates, media, webhook handling, constraints). There is no obvious instruction to read arbitrary system files or to transmit data to endpoints outside Meta's graph.facebook.com or user-specified media hosts. Note: the SKILL.md references environment variables and webhook setup that are needed at runtime but were not declared in metadata.
✓ 安装机制
This is an instruction-only skill with no install spec and no code files — lowest install risk. The samples suggest installing common libs (axios, requests) but the skill does not itself install packages or download remote code.
⚠ 凭证需求
The SKILL.md expects sensitive values in environment variables (WA_ACCESS_TOKEN, WA_PHONE_NUMBER_ID, VERIFY_TOKEN and potentially a System User token), yet the skill declares none. Requiring these credentials would be proportional to the purpose, but failing to declare them is a red flag: users won't be warned that secrets are needed, and an automated system may not protect them appropriately.
✓ 持久化与权限
The skill is not always-included and does not request persistent privileges. There is no evidence it attempts to modify other skills or system-wide settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/24
Initial release featuring WhatsApp Cloud API integration guide: - Detailed setup checklist for Meta WhatsApp Cloud API and WhatsApp Business Account. - Code samples for sending messages (Node.js, Python, curl) and templates for various message types (text, template, image, document, audio, video). - Common troubleshooting info: message status tracking, delivery errors, token handling, template rejection, rate limits, webhook setup, and quality rating issues. - Webhook handler example (Express.js) for correct async processing and callback verification. - Clear documentation of conversation rules and 24-hour reply windows.
● 无害
安装命令
点击复制官方npx clawhub@latest install whatsapp-cloud-api-reference
镜像加速npx clawhub@latest install whatsapp-cloud-api-reference --registry https://cn.longxiaskill.com