Security Audit

WhatsApp Automation & A2A

github.com/openclaw/skills

AI SkillCommit 13146e6a3d46

CAUTION

Scanned about 2 months ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

WhatsApp Automation & A2A received a trust score of 62/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.

SkillShield's automated analysis identified 6 findings: 0 critical, 0 high, 5 medium, and 1 low severity. Key findings include Suspicious import: requests, Node lockfile missing.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Static Code Analysis layer scored lowest at 65/100, indicating areas for improvement.

Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

65%

Dependency Graph

98%

LLM Behavioral Safety

100%

Behavioral Risk Signals

Network Access

5 findings

Filesystem Write

1 finding

Excessive Permissions

5 findings

Security Findings6

Severity	Finding	Layer	Location
MEDIUM	Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/alex-tradequo/whatsapp-automation-a2a/scripts/a2a_client.py:7
MEDIUM	Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/alex-tradequo/whatsapp-automation-a2a/scripts/admin.py:6
MEDIUM	Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/alex-tradequo/whatsapp-automation-a2a/scripts/ai_config.py:6
MEDIUM	Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/alex-tradequo/whatsapp-automation-a2a/scripts/quickstart.py:6
MEDIUM	Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/alex-tradequo/whatsapp-automation-a2a/scripts/reviews.py:6
LOW	Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution.	Dependencies	skills/alex-tradequo/whatsapp-automation-a2a/package.json

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/2227fe355a9a9e5c.svg)](https://skillshield.io/report/2227fe355a9a9e5c)