ops-whatsapp-biz
Facilitates business messaging via WhatsApp Business Cloud API, enabling template management and product catalog integration.
Install this skill
Security score
The ops-whatsapp-biz skill was audited on May 29, 2026 and we found 22 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 23 | ```bash |
Template literal with variable interpolation in command context
| 68 | ```bash |
Template literal with variable interpolation in command context
| 111 | ```bash |
Template literal with variable interpolation in command context
| 199 | ```bash |
Template literal with variable interpolation in command context
| 249 | ```bash |
Template literal with variable interpolation in command context
| 281 | ```bash |
Template literal with variable interpolation in command context
| 367 | ```bash |
Curl to non-GitHub URL
| 69 | RESULT=$(curl -s "https://graph.facebook.com/v20.0/${WABA_ACCOUNT_ID}/message_templates?fields=name,status,category,language,components&limit=50" \ |
Curl to non-GitHub URL
| 127 | RESP=$(curl -s -X POST "https://graph.facebook.com/v20.0/${WABA_PHONE_ID}/messages" \ |
Curl to non-GitHub URL
| 222 | RESP=$(curl -s -X POST "https://graph.facebook.com/v20.0/${WABA_ACCOUNT_ID}/message_templates" \ |
Curl to non-GitHub URL
| 256 | RESULT=$(curl -s "https://graph.facebook.com/v20.0/${WABA_ACCOUNT_ID}/message_templates?name=${TEMPLATE_NAME_ARG}&fields=name,status,rejected_reason,quality_score" \ |
Curl to non-GitHub URL
| 283 | CATALOGS=$(curl -s "https://graph.facebook.com/v20.0/${WABA_ACCOUNT_ID}?fields=catalog_id" \ |
Curl to non-GitHub URL
| 294 | PRODUCTS=$(curl -s "https://graph.facebook.com/v20.0/${CATALOG_ID}/products?fields=id,name,retailer_id,price,availability,url&limit=20" \ |
Curl to non-GitHub URL
| 368 | TEST=$(curl -s "https://graph.facebook.com/v20.0/${WABA_PHONE_ID}" \ |
Access to hidden dotfiles in home directory
| 337 | grep -h 'WHATSAPP_BUSINESS\|WHATSAPP_PHONE' ~/.zshrc ~/.bashrc ~/.zprofile ~/.envrc 2>/dev/null | grep -v '^#' |
External URL reference
| 69 | RESULT=$(curl -s "https://graph.facebook.com/v20.0/${WABA_ACCOUNT_ID}/message_templates?fields=name,status,category,language,components&limit=50" \ |
External URL reference
| 127 | RESP=$(curl -s -X POST "https://graph.facebook.com/v20.0/${WABA_PHONE_ID}/messages" \ |
External URL reference
| 222 | RESP=$(curl -s -X POST "https://graph.facebook.com/v20.0/${WABA_ACCOUNT_ID}/message_templates" \ |
External URL reference
| 256 | RESULT=$(curl -s "https://graph.facebook.com/v20.0/${WABA_ACCOUNT_ID}/message_templates?name=${TEMPLATE_NAME_ARG}&fields=name,status,rejected_reason,quality_score" \ |
External URL reference
| 283 | CATALOGS=$(curl -s "https://graph.facebook.com/v20.0/${WABA_ACCOUNT_ID}?fields=catalog_id" \ |
External URL reference
| 294 | PRODUCTS=$(curl -s "https://graph.facebook.com/v20.0/${CATALOG_ID}/products?fields=id,name,retailer_id,price,availability,url&limit=20" \ |
External URL reference
| 368 | TEST=$(curl -s "https://graph.facebook.com/v20.0/${WABA_PHONE_ID}" \ |