📦
content-creator
88Create Brand-Consistent Marketing Content
Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.
Writing & Content View
Skills observe-whatsapp
📦
observe-whatsapp
Content revision r1 High Risk ⚙️ External commands🌐 Network access🔑 Env variables
Troubleshoot WhatsApp Delivery
WhatsApp delivery failures can be hard to trace across messages, webhooks, and API logs. This skill provides operational checklists and command patterns for focused Kapso diagnostics.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "observe-whatsapp" from https://skillstore.io/skills/sickn33-observe-whatsapp.md and its manifest at https://skillstore.io/api/skills/sickn33-observe-whatsapp/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "observe-whatsapp". A support engineer reports that a WhatsApp message did not arrive.
Expected outcome:
- Message status reviewed with the provided message ID.
- Conversation context checked for related delivery events.
- Likely failure cause and next action summarized for escalation.
Using "observe-whatsapp". A webhook endpoint is returning intermittent failures.
Expected outcome:
- Webhook delivery attempts grouped by status and time window.
- Recent API log errors compared with delivery retries.
- Endpoint behavior summarized with recommended owner follow-up.
Using "observe-whatsapp". An operations lead wants a WhatsApp health review before launch.
Expected outcome:
- Project overview and phone number health checked.
- Configuration warnings listed with severity and owner.
- Launch readiness summarized in plain language.
Security Audit
High Riskv4 • 7/7/2026 Open versioned report
Most static command findings are Markdown formatting false positives. Confirmed risks remain for command-oriented workflows, API key handling, and sensitive WhatsApp message and log inspection. No prompt injection text was found in SKILL.md.
1
Files scanned
110
Lines analyzed
11
Review items
0
False positives ignored
Confirmed security concerns (1)
High
Sensitive WhatsApp Data Access
The skill instructs users to list messages, inspect message details, find conversations, and list API logs and webhook deliveries. These actions can expose phone numbers, message content, delivery metadata, and incident data.
The described workflows directly target messages, conversations, API logs, and webhook deliveries in SKILL.md. The risk is clear even though access may be authorized.
Capability review items (11)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
- `KAPSO_API_KEY`
The skill requires KAPSO_API_KEY and then directs API-driven diagnostics over message and log data. No exfiltration is shown, but secret handling is a real trust boundary.
Medium
Ruby/shell backtick execution
1. List messages: `node scripts/messages.js --phone-number-id <id>`
This is a Markdown instruction to run npm or Node commands for local diagnostic scripts. Those commands execute code outside SKILL.md and may use API credentials.
Medium
Ruby/shell backtick execution
2. Inspect message: `node scripts/message-details.js --message-id <id>`
This is a Markdown instruction to run npm or Node commands for local diagnostic scripts. Those commands execute code outside SKILL.md and may use API credentials.
Medium
Ruby/shell backtick execution
3. Find conversation: `node scripts/lookup-conversation.js --phone-number <e164>`
This is a Markdown instruction to run npm or Node commands for local diagnostic scripts. Those commands execute code outside SKILL.md and may use API credentials.
Medium
Ruby/shell backtick execution
1. Message errors: `node scripts/errors.js`
This is a Markdown instruction to run npm or Node commands for local diagnostic scripts. Those commands execute code outside SKILL.md and may use API credentials.
Medium
Ruby/shell backtick execution
2. API logs: `node scripts/api-logs.js`
This is a Markdown instruction to run npm or Node commands for local diagnostic scripts. Those commands execute code outside SKILL.md and may use API credentials.
Medium
Ruby/shell backtick execution
3. Webhook deliveries: `node scripts/webhook-deliveries.js`
This is a Markdown instruction to run npm or Node commands for local diagnostic scripts. Those commands execute code outside SKILL.md and may use API credentials.
Medium
Ruby/shell backtick execution
1. Project overview: `node scripts/overview.js`
This is a Markdown instruction to run npm or Node commands for local diagnostic scripts. Those commands execute code outside SKILL.md and may use API credentials.
Medium
Ruby/shell backtick execution
2. Phone number health: `node scripts/whatsapp-health.js --phone-number-id <id>`
This is a Markdown instruction to run npm or Node commands for local diagnostic scripts. Those commands execute code outside SKILL.md and may use API credentials.
Medium
Ruby/shell backtick execution
```bash
This is a Markdown instruction to run npm or Node commands for local diagnostic scripts. Those commands execute code outside SKILL.md and may use API credentials.
Medium
Ruby/shell backtick execution
```bash
This is a Markdown instruction to run npm or Node commands for local diagnostic scripts. Those commands execute code outside SKILL.md and may use API credentials.
Risk Factors
⚙️ External commands (27)
SKILL.md:17 SKILL.md:18 SKILL.md:24 SKILL.md:25 SKILL.md:26 SKILL.md:30 SKILL.md:31 SKILL.md:32 SKILL.md:36 SKILL.md:37 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:53 SKILL.md:54 SKILL.md:55 SKILL.md:61 SKILL.md:62 SKILL.md:68 SKILL.md:71-73 SKILL.md:73-76 SKILL.md:76-80 SKILL.md:80-84 SKILL.md:84-94 SKILL.md:94-95 SKILL.md:95-98 SKILL.md:98-107
🌐 Network access (1)
🔑 Env variables (1)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-observe-whatsapp/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-observe-whatsapp?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-observe-whatsapp?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-observe-whatsapp/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-observe-whatsapp.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). observe-whatsapp security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-observe-whatsapp/audits/4BibTeX citation
@techreport{sickn33-sickn33-observe-whatsapp-2026,
author = {sickn33},
title = {observe-whatsapp security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-observe-whatsapp/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "observe-whatsapp security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-observe-whatsapp/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-observe-whatsapp:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
68
Community
83
Spec Compliance
What You Can Build
Investigate Failed Deliveries
Trace a reported delivery issue from message lists to message details and conversation lookup.
Review Webhook Retries
Check webhook delivery attempts and related API logs during an integration incident.
Run Health Checks
Verify project overview and phone number health before escalating a WhatsApp incident.
Try These Prompts
Check Phone Number Health
Use observe-whatsapp to check health for phone number ID <id>. Summarize status, errors, and next actions.
Inspect Message Delivery
Investigate message ID <id> with observe-whatsapp. Include delivery state, related conversation, and likely failure causes.
Triage Webhook Failures
Use observe-whatsapp to review webhook deliveries and API logs for <time window>. Identify retry patterns and failed endpoints.
Correlate Incident Evidence
Use observe-whatsapp to build an incident timeline for phone number ID <id>, message ID <id>, and webhook failures in <time window>.
Best Practices
- Use least-privilege API keys and rotate them after incident response work.
- Confirm user authorization before inspecting message, conversation, or webhook data.
- Record findings with message IDs, phone number IDs, timestamps, and clear next actions.
Avoid
- Do not run diagnostics against production data without approval.
- Do not paste API keys or message contents into shared prompts or tickets.
- Do not assume webhook failures are message failures without checking both data sources.
Frequently Asked Questions
What does this skill help troubleshoot?
It helps investigate WhatsApp message delivery, webhook retries, API errors, and phone number health in Kapso.
Does it send WhatsApp messages?
No. The skill is focused on observation, diagnostics, and triage workflows.
What setup is required?
The skill documents KAPSO_API_BASE_URL and KAPSO_API_KEY as required environment variables.
Can it inspect production message data?
Yes, if the configured API key has access. Users should confirm authorization and redact sensitive data.
Are the referenced scripts included in this audit?
No. The audited package contains only SKILL.md, so script behavior was not reviewed.
Does it manage webhook configuration?
No. The skill points users to integrate-whatsapp for webhook setup and changes.
Developer Details
Author
sickn33License
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
816c62b2546ddb1c6a0453e7c781b5e095117819
Maintenance freshness
7/18/2026
Usage
8 downloads · 87 views
File structure
📄 SKILL.md
More from sickn33
View all📦
prompt-engineering-patterns
85Improve LLM Prompts With Proven Patterns
Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.
Productivity View
📦
senior-architect
81Review Architecture Workflows and Project Paths
Architecture reviews need a consistent starting point and clear project boundaries. This skill provides workspace-scoped tool templates, command examples, and generic design references.
Coding & Development View
📦
senior-fullstack
81Review Fullstack Project Foundations
Fullstack project setup can require many tools and checks. This skill provides basic local wrappers, common commands, and general engineering guidance.
Coding & Development View
📦
prompt-engineer
81Optimize AI Prompts With Prompt Engineer
Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.
Productivity View
📦
product-manager-toolkit
80Prioritize Product Work With Research Insights
Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.
Productivity View
Related Skills
View all📦
sent-templates
77Manage Sent Message Templates
by sentdm
Finding the correct Sent template across languages, channels, and organizations can be difficult. This skill discovers, inspects, and safely deletes exact template records.
Communication View
📦
waba-embedded-signup
75Plan Secure WABA Embedded Signup
by sentdm
WABA onboarding can mix incompatible signup paths, credentials, and callback contracts. This skill guides secure Sent profile setup, verification, testing, and failure recovery.
Communication View
📦
sent
74Route Sent Messaging Requests
by sentdm
Broad Sent requests can involve several channels, operations, and compliance workflows. This skill clarifies intent and routes each request to the appropriate specialist.
Communication View
📦
sent-routing-strategist
74Plan Sent Message Routing
by sentdm
Incorrect channel choices can cause duplicate deliveries, extra charges, failed fallback, and unsafe retries. This skill explains routing decisions and diagnoses outcomes from Sent evidence.
Communication View
📦
sequenzy
38Manage Sequenzy Workflows With CLI Guidance
by Sequenzy
Sequenzy tasks can span many CLI and MCP commands. This skill maps requests to supported workflows, caveats, and review links.
Communication View
📦
sent-integration-starter
80Build a Reliable Sent Integration
by sentdm
Messaging integrations can fail through duplicate sends, unsafe retries, weak webhook validation, or incorrect credential scope. This skill provides a staged Sent v3 implementation and launch review.
Coding & Development View