telnyx-whatsapp-javascript
Enables sending WhatsApp messages and managing templates via the Telnyx WhatsApp Business API using JavaScript.
Install this skill
Security score
The telnyx-whatsapp-javascript skill was audited on May 13, 2026 and we found 18 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 48 | console.log(`API error: ${error.status} - ${error.message}`); |
Template literal with variable interpolation in command context
| 188 | console.log(`${waba.id}: ${waba.name} (${waba.status})`); |
Template literal with variable interpolation in command context
| 214 | console.log(`${tmpl.id}: ${tmpl.name} (${tmpl.category}) - ${tmpl.status}`); |
Template literal with variable interpolation in command context
| 246 | console.log(`Template created: ${response.data.id} (status: ${response.data.status})`); |
Template literal with variable interpolation in command context
| 258 | console.log(`${pn.phone_number} - quality: ${pn.quality_rating}`); |
Webhook reference - potential data exfiltration
| 87 | Do not invent Telnyx parameters, enums, response fields, or webhook fields. |
Webhook reference - potential data exfiltration
| 91 | - Before reading or matching webhook fields beyond the inline examples, read [the webhook payload reference](references/api-details.md#webhook-payload-fields). |
Webhook reference - potential data exfiltration
| 108 | | `webhook_url` | string (URL) | No | Callback URL for delivery status updates | |
Webhook reference - potential data exfiltration
| 264 | ### Webhook Verification |
Webhook reference - potential data exfiltration
| 266 | Telnyx signs webhooks with Ed25519. Always verify signatures in production: |
Webhook reference - potential data exfiltration
| 269 | import { Webhook } from 'telnyx'; |
Webhook reference - potential data exfiltration
| 271 | const event = Webhook.constructEvent( |
Webhook reference - potential data exfiltration
| 279 | ## Webhooks |
Webhook reference - potential data exfiltration
| 281 | These webhook payload fields are inline because they are part of the primary integration path. |
Webhook reference - potential data exfiltration
| 320 | | Configure webhooks | `client.whatsapp.businessAccounts.settings.update()` | Subscribe to events | |
Webhook reference - potential data exfiltration
| 333 | | Configure webhooks | `client.whatsapp.businessAccounts.settings.update()` | `PATCH /v2/whatsapp/business_accounts/:id/settings` | `waba_id` | |
Access to .env file
| 25 | const client = new Telnyx({ apiKey: process.env['TELNYX_API_KEY'] }); |
Reading sensitive environment variables
| 25 | const client = new Telnyx({ apiKey: process.env['TELNYX_API_KEY'] }); |