Latest release: v2026.10.6Download zip
Compatibility
Security Scan
OpenClaw
Benign
high confidenceCredentials
Private messages and outbound messaging are expected capabilities. Full-history synchronization is disabled in the channel socket; message sharing with other plugins requires opt-in.
Install Mechanism
The package declares standard dependencies and no root install scripts. The inspected bundled dependency preinstall script only checks the Node.js version.
Instruction Scope
The CLI skill requires explicit requests and confirmation before sending; runtime login is owner-restricted, with pairing and group access controls.
Persistence & Privilege
Linked-device credentials persist locally for channel operation. Credential writes use restrictive permissions, migrations preserve backups, and optional calls are disabled by default and restricted to the current requester.
Purpose & Capability
Account linking, chat monitoring, replies, and optional history searches align with the disclosed WhatsApp integration.
Assessment
Use a separate WhatsApp number and restrict approved contacts and groups. Protect stored session credentials and any synchronized history. Enable message-sharing hooks only for trusted plugins; revoke the linked device in WhatsApp when access is no longer needed.node_modules/baileys/lib/Utils/messages-media.js:88
Shell command execution detected (child_process).
node_modules/baileys/node_modules/pino/benchmarks/utils/generate-benchmark-doc.js:7
Shell command execution detected (child_process).
node_modules/baileys/node_modules/pino/benchmarks/utils/runbench.js:75
Shell command execution detected (child_process).
node_modules/baileys/node_modules/pino/test/pkg/pkg.test.js:29
Shell command execution detected (child_process).
node_modules/baileys/node_modules/process-warning/test/no-warnings.test.js:11
Shell command execution detected (child_process).
node_modules/baileys/node_modules/thread-stream/test/pkg/pkg.test.js:19
Shell command execution detected (child_process).
node_modules/baileys/node_modules/pino/test/esm/index.test.js:15
Dynamic code execution detected.
node_modules/baileys/node_modules/pino/test/fixtures/eval/index.js:3
Dynamic code execution detected.
node_modules/baileys/node_modules/real-require/src/index.js:4
Dynamic code execution detected.
node_modules/baileys/node_modules/@pinojs/redact/test/actual-redact-comparison.test.js:126
File appears to expose a hardcoded API secret or token.
node_modules/baileys/node_modules/@pinojs/redact/test/multiple-wildcards.test.js:204
File appears to expose a hardcoded API secret or token.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Verification
Tags
OpenClaw WhatsApp
Official OpenClaw channel plugin for WhatsApp Web chats.
Install from OpenClaw:
openclaw plugins install @openclaw/whatsapp
Link a WhatsApp account through the plugin's setup flow, then configure which chats OpenClaw agents should monitor and reply to.