add-whatsapp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited add-whatsapp (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Adds WhatsApp support via the native Baileys adapter (no Chat SDK bridge).
NanoClaw doesn't ship channels in trunk. This skill copies the native WhatsApp (Baileys) adapter and its whatsapp-auth setup step in from the channels branch. No Chat SDK bridge.
Skip to Credentials if all of these are already in place:
src/channels/whatsapp.ts existssrc/channels/whatsapp-registration.test.ts existssrc/channels/whatsapp.test.ts existssrc/channels/index.ts contains import './whatsapp.js';setup/whatsapp-auth.ts and setup/groups.ts both existsetup/index.ts's STEPS map contains both 'whatsapp-auth': and groups:@whiskeysockets/baileys, qrcode, pino are listed in package.json dependencies.claude/skills/add-whatsapp/scripts/wa-qr-browser.ts exists (ships with this skill)Otherwise continue. Every step below is safe to re-run.
git fetch origin channelsgit show origin/channels:src/channels/whatsapp.ts > src/channels/whatsapp.ts
git show origin/channels:src/channels/whatsapp-registration.test.ts > src/channels/whatsapp-registration.test.ts
git show origin/channels:src/channels/whatsapp.test.ts > src/channels/whatsapp.test.ts
git show origin/channels:setup/whatsapp-auth.ts > setup/whatsapp-auth.ts
git show origin/channels:setup/groups.ts > setup/groups.tsAppend to src/channels/index.ts (skip if already present):
import './whatsapp.js';In setup/index.ts, add these entries to the STEPS map (skip lines already present):
groups: () => import('./groups.js'),
'whatsapp-auth': () => import('./whatsapp-auth.js'),pnpm install @whiskeysockets/[email protected] [email protected] @types/[email protected] [email protected]pnpm run build
pnpm exec vitest run src/channels/whatsapp-registration.test.tsBoth must be clean before proceeding. whatsapp-registration.test.ts is the one integration test: it imports the real channel barrel and asserts the registry contains whatsapp. It goes red if the import './whatsapp.js'; line is deleted or drifts, if the barrel fails to evaluate (so the channel genuinely would not register), or if @whiskeysockets/baileys isn't installed (the import throws) — so it also implicitly verifies the dependency from step 5.
End-to-end message delivery against a real WhatsApp number is verified manually once the service is running — see Credentials, Wiring, and Troubleshooting.
WhatsApp uses linked-device authentication — no API key, just a one-time pairing from your phone.
Check if WhatsApp is already authenticated. If store/auth/creds.json exists, skip to "Shared vs dedicated number".
test -f store/auth/creds.json && echo "WhatsApp auth exists" || echo "No WhatsApp auth"Check whether the environment is headless (no display server):
[[ -z "$DISPLAY" && -z "$WAYLAND_DISPLAY" && "$OSTYPE" != darwin* ]] && echo "IS_HEADLESS=true" || echo "IS_HEADLESS=false"Use AskUserQuestion to collect configuration. Adapt auth options based on environment:
If IS_HEADLESS=true AND not WSL → AskUserQuestion: How do you want to authenticate WhatsApp?
Otherwise (macOS, desktop Linux, or WSL) → AskUserQuestion: How do you want to authenticate WhatsApp?
If they chose pairing code:
AskUserQuestion: What is your phone number? (Digits only — country code followed by your 10-digit number, no + prefix, spaces, or dashes. Example: 14155551234 where 1 is the US country code and 4155551234 is the phone number.)
rm -rf store/auth/For QR code in browser (recommended):
pnpm exec tsx .claude/skills/add-whatsapp/scripts/wa-qr-browser.ts(Bash timeout: 150000ms)
The wrapper spawns setup/index.ts --step whatsapp-auth -- --method qr, parses each rotating QR from its WHATSAPP_AUTH_QR status blocks, and serves the current QR as a PNG on a local HTTP server (default port 8765, falls back to a free port). Flags: --clean (wipes store/auth/ before spawning) and --port N.
Tell the user:
A browser window will open with a QR code.
>
1. Open WhatsApp > Settings > Linked Devices > Link a Device 2. Scan the QR code in the browser 3. The page will show "Authenticated!" when done
For QR code in terminal:
pnpm exec tsx setup/index.ts --step whatsapp-auth -- --method qr(Bash timeout: 150000ms)
The setup driver emits each rotating QR as a WHATSAPP_AUTH_QR status block; when run directly (not through setup:auto) the raw QR string is printed and your terminal must render it as ASCII. If your terminal can't render it readably, use the browser method above.
Tell the user:
1. Open WhatsApp > Settings > Linked Devices > Link a Device 2. Scan the QR code displayed in the terminal
For pairing code:
Tell the user to have WhatsApp open on Settings > Linked Devices > Link a Device, ready to tap "Link with phone number instead" — the code expires in ~60 seconds and must be entered immediately.
Run the auth process in the background and poll store/pairing-code.txt for the code:
rm -f store/pairing-code.txt && pnpm exec tsx setup/index.ts --step whatsapp-auth -- --method pairing-code --phone <their-phone-number> > /tmp/wa-auth.log 2>&1 &Then immediately poll for the code (do NOT wait for the background command to finish):
for i in $(seq 1 20); do [ -f store/pairing-code.txt ] && cat store/pairing-code.txt && break; sleep 1; doneDisplay the code to the user the moment it appears. Tell them:
Enter this code now — it expires in ~60 seconds.
>
1. Open WhatsApp > Settings > Linked Devices > Link a Device 2. Tap Link with phone number instead 3. Enter the code immediately
After the user enters the code, poll for authentication to complete:
for i in $(seq 1 60); do grep -q 'STATUS: authenticated' /tmp/wa-auth.log 2>/dev/null && echo "authenticated" && break; grep -q 'STATUS: failed' /tmp/wa-auth.log 2>/dev/null && echo "failed" && break; sleep 2; doneIf failed: logged_out → delete store/auth/ and re-run. timeout → ask user, offer retry.
test -f store/auth/creds.json && echo "Authentication successful" || echo "Authentication failed"AskUserQuestion: Is this a shared phone number (personal WhatsApp) or a dedicated number?
If dedicated, add to .env:
ASSISTANT_HAS_OWN_NUMBER=trueIf you're in the middle of /setup, return to the setup flow now.
Otherwise, run /manage-channels to wire this channel to an agent group.
whatsapp<phone>@s.whatsapp.net (e.g. [email protected]). Groups use <id>@g.us. To find your number: node -e "const c=JSON.parse(require('fs').readFileSync('store/auth/creds.json','utf-8'));console.log(c.me?.id?.split(':')[0]+'@s.whatsapp.net')". Groups are auto-discovered — check pnpm exec tsx scripts/q.ts data/v2.db "SELECT platform_id, name FROM messaging_groups WHERE channel_type='whatsapp' AND is_group=1".**bold**→*bold*, *italic*→_italic_, headings→bold, code blocks preservedask_user_question renders with /approve, /reject slash commandsNot supported (WhatsApp linked device limitation): edit messages, delete messages.
QR codes expire after ~60 seconds. The browser wrapper rotates automatically as long as it's running; if it was stopped, re-run with --clean:
pnpm exec tsx .claude/skills/add-whatsapp/scripts/wa-qr-browser.ts --cleanCodes expire in ~60 seconds. Delete auth and retry:
rm -rf store/auth/ && pnpm exec tsx setup/index.ts --step whatsapp-auth -- --method pairing-code --phone <phone>Ensure: digits only (no +), phone has internet, WhatsApp is updated.
WhatsApp's pairing-code flow occasionally rejects valid codes with "Couldn't link device — An error happened. Please try again." This is a server-side rejection unrelated to the code itself; we've seen it happen twice in a row on fresh dedicated numbers. If you hit it more than once, switch to QR-browser auth — it has a noticeably higher success rate:
pnpm exec tsx .claude/skills/add-whatsapp/scripts/wa-qr-browser.ts --cleanSignal sessions corrupted from rapid restarts. Clear sessions.
Run from your NanoClaw project root:
source setup/lib/install-slug.sh
systemctl --user stop $(systemd_unit)
rm store/auth/session-*.json
systemctl --user start $(systemd_unit)test -f store/auth/creds.jsongrep "Connected to WhatsApp" logs/nanoclaw.log | tail -1pnpm exec tsx scripts/q.ts data/v2.db "SELECT mg.platform_id, mg.name FROM messaging_groups mg JOIN messaging_group_agents mga ON mg.id=mga.messaging_group_id WHERE mg.channel_type='whatsapp'"systemctl --user status "$(. setup/lib/install-slug.sh && systemd_unit)"Two instances connected with same credentials. Ensure only one NanoClaw process is running.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.