Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- node_modules/baileys/lib/Utils/messages-media.js:88
- Evidence
exec(cmd, err => {
Security audit
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent WhatsApp channel plugin that discloses its messaging, login, credential storage, and optional history/search tooling.
Install only if you want OpenClaw to read and send WhatsApp messages through a linked WhatsApp Web session. Review dmPolicy, allowFrom, groupPolicy, pluginHooks.messageReceived, and any wacli history sync settings before enabling broad access or third-party message sending.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.exposed_secret_literal
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- node_modules/baileys/node_modules/pino/benchmarks/utils/generate-benchmark-doc.js:7
- Evidence
return execSync(`node ${join(__dirname, 'runbench')} ${type} -q`)
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- node_modules/baileys/node_modules/pino/benchmarks/utils/runbench.js:75
- Evidence
const benchmark = spawn(
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- node_modules/baileys/node_modules/pino/test/pkg/pkg.test.js:29
- Evidence
const { stderr } = await execFile('npx', ['pkg', filePath, '--config', configPath], { shell: true })
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- node_modules/baileys/node_modules/process-warning/test/no-warnings.test.js:11
- Evidence
const child = spawnSync(process.execPath, [
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- node_modules/baileys/node_modules/thread-stream/test/pkg/pkg.test.js:19
- Evidence
const { stderr } = await exec(`npx pkg ${filePath} --config ${configPath}`)
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/baileys/node_modules/pino/test/esm/index.test.js:15
- Evidence
new Function('module', 'return import(module)')('./esm.mjs').catch((err) => {
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/baileys/node_modules/pino/test/fixtures/eval/index.js:3
- Evidence
eval(`
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/baileys/node_modules/real-require/src/index.js:4
- Evidence
const realImport = new Function('modulePath', 'return import(modulePath)')
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- node_modules/baileys/node_modules/@pinojs/redact/test/actual-redact-comparison.test.js:126
- Evidence
password: '[REDACTED]'
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- node_modules/baileys/node_modules/@pinojs/redact/test/multiple-wildcards.test.js:204
- Evidence
authorization: '[REDACTED]'