claude-channel-whatsapp Security Audit Report

🔭 Continuously monitored by ClawSecure Watchtower

Source:

SHA-256:

claude-channel-whatsapp is an AI agent skill, created by Rich627 and published at Rich627/whatsapp-claude-plugin. ClawSecure audited claude-channel-whatsapp across 52 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 50/100 (Medium Risk). The 5 findings concentrate in Supply Chain, Code Injection and Permissions Manifest, including Vulnerability in @whiskeysockets/baileys@7.0.0-rc.9:… and Potentially dangerous code pattern detected: curl.*\|.*sh. 3 were rated high or critical severity.

Is claude-channel-whatsapp safe?

ClawSecure audited claude-channel-whatsapp and assigned a security score of 50/100 (Medium Risk), identifying 5 findings across Supply Chain and Code Injection. Review the findings below before installing.

What did ClawSecure find in claude-channel-whatsapp?

ClawSecure identified 5 findings in claude-channel-whatsapp, concentrated in Supply Chain, Code Injection and Permissions Manifest. 3 were rated high or critical severity. The most severe include Vulnerability in @whiskeysockets/baileys@7.0.0-rc.9:… and Potentially dangerous code pattern detected: curl.*\|.*sh.

How was claude-channel-whatsapp audited?

ClawSecure ran claude-channel-whatsapp through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 52 files from Rich627/whatsapp-claude-plugin.

What does a score of 50 mean?

ClawSecure assigned claude-channel-whatsapp a security score of 50/100, placing it in the Medium Risk range. This reflects 5 findings led by Supply Chain that warrant review before production use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).

Audit Findings for claude-channel-whatsapp

ClawSecure detected 5 security findings in claude-channel-whatsapp, spanning Supply Chain, Code Injection, Permissions Manifest and ReDoS.

critical · Vulnerability in @whiskeysockets/baileys@7.0.0-rc.9:…. Supply Chain finding detected in package.json.
high · Potentially dangerous code pattern detected: curl.*\|.*sh. Code Injection finding detected in USAGE.md.
high · Vulnerability in @modelcontextprotocol/sdk@1.0.0: Model…. Supply Chain finding detected in package.json.
medium · Missing config.json - agent may not be properly configured. Permissions Manifest finding.
medium · ReDoS vulnerability: Nested quantifiers (potential…. ReDoS finding detected in 2026-07-18-doctor-skill.md:210.

Each finding is expandable in the interactive list below.

3-Layer Audit Protocol

Security Recommendations for claude-channel-whatsapp

Update and pin dependencies

claude-channel-whatsapp depends on packages with supply-chain risk. Pin every dependency to an exact version, update packages with known CVEs to patched releases, and re-audit after each change. ClawSecure checks every dependency against known CVE databases.

Eliminate dynamic code execution

claude-channel-whatsapp evaluates code at runtime (for example eval or dynamic exec). Remove dynamic evaluation of untrusted input, and where code generation is unavoidable, sandbox it and validate every input.

Add a config.json permissions manifest

A config.json file declares what an agent component can access: file system, network, shell execution and more. Without it, users have no visibility into what the component can do before installing. This is the single most impactful security improvement for any AI agent skill.

Fix ReDoS-prone patterns

claude-channel-whatsapp contains regular expressions vulnerable to catastrophic backtracking (ReDoS). Replace vulnerable patterns, bound input length, and prefer linear-time matching so a crafted input cannot hang the agent.

Related Security Research

AI Agent Supply Chain Attacks: How Dependencies Become Weapons→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→Why Generic Scanners Fail at AI Agent Security→

Related AI Agent Security Audits

probe-14-webhookScore 50/100 feishu-imageScore 35/100 zoho-email-integrationScore 65/100 clawdbot-zoho-emailScore 65/100 clawdbot-zoho-emailScore 65/100

Scanned on August 23, 2026. claude-channel-whatsapp is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.

Start Your Free Scan