Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix wacli skill: add recipient allowlist and confirm-before-send enforcement [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#56898•Fetched 2026-04-08 01:46:22
View on GitHub
Comments
0
Participants
1
Timeline
0
Reactions
0
Author
xinbenlvxinbenlv
Participants
xinbenlvxinbenlv

The wacli skill (WhatsApp CLI wrapper) currently relies on soft agent-level guardrails in its SKILL.md. Since wacli can send messages to arbitrary WhatsApp contacts, stronger safety patterns should be enforced at the SKILL.md instruction level to prevent accidental or unauthorized message delivery.

Root Cause

The wacli skill (WhatsApp CLI wrapper) currently relies on soft agent-level guardrails in its SKILL.md. Since wacli can send messages to arbitrary WhatsApp contacts, stronger safety patterns should be enforced at the SKILL.md instruction level to prevent accidental or unauthorized message delivery.

RAW_BUFFERClick to expand / collapse

Summary

The wacli skill (WhatsApp CLI wrapper) currently relies on soft agent-level guardrails in its SKILL.md. Since wacli can send messages to arbitrary WhatsApp contacts, stronger safety patterns should be enforced at the SKILL.md instruction level to prevent accidental or unauthorized message delivery.

Background

On 2026-03-15, exec guardrails were implemented in OpenClaw with pass-through wrappers and audit logging for tools like xurl and wacli. However, the official SKILL.md files only contain soft agent-level guardrails — meaning a misconfigured or overly permissive agent could send WhatsApp messages without proper user confirmation.

Proposed Improvements

1. Recipient allowlist concept

  • SKILL.md should instruct agents to maintain or reference a recipient allowlist (configurable per-user).
  • Messages to contacts not on the allowlist should require explicit user confirmation with the recipient name and phone number displayed.
  • Messages to allowlisted contacts should still show a confirmation with the message content before sending.
  • The allowlist could be stored in the agent's workspace (e.g., TOOLS.md or a dedicated config file).

2. Confirm-before-send enforcement

  • SKILL.md should instruct agents to always confirm with the user before sending any message, showing:
    • Recipient name/number
    • Full message content
    • Any media attachments
  • Only after explicit user approval should the send command execute.

3. Audit log instructions

  • SKILL.md should instruct agents to log all send operations to an audit trail (e.g., /tmp/ttl=30d/wacli-audit/YYYY-MM-DD.log).
  • Each log entry should include: timestamp, recipient (name only, not full phone number), message summary (first 50 chars), and result.
  • Phone numbers and message content beyond the summary must be redacted from logs.

4. Bulk send protection

  • Explicitly prohibit sending the same or similar message to multiple recipients without per-recipient confirmation.
  • No broadcast/bulk operations without explicit user request and confirmation of the full recipient list.

Impact

This change improves safety for all OpenClaw users who use the wacli skill, ensuring that WhatsApp messages — a highly personal and direct communication channel — always have human-in-the-loop confirmation before delivery.

extent analysis

Fix Plan

To address the issue, we need to implement the following improvements in the wacli skill:

  • Recipient allowlist concept
  • Confirm-before-send enforcement
  • Audit log instructions
  • Bulk send protection

Here are the concrete steps:

  • Update SKILL.md to instruct agents to maintain a recipient allowlist and store it in the agent's workspace (e.g., TOOLS.md or a dedicated config file).
  • Modify the wacli code to check if the recipient is on the allowlist before sending a message. If not, prompt the user for explicit confirmation.
  • Implement confirm-before-send enforcement by displaying the recipient name/number, full message content, and any media attachments before sending the message.
  • Update the wacli code to log all send operations to an audit trail (e.g., /tmp/ttl=30d/wacli-audit/YYYY-MM-DD.log) with redacted phone numbers and message content.
  • Add a check to prohibit bulk send operations without explicit user request and confirmation of the full recipient list.

Example code snippet in Python:

import logging

# Load allowlist from config file
allowlist = load_allowlist_from_config()

def send_message(recipient, message):
    # Check if recipient is on allowlist
    if recipient not in allowlist:
        # Prompt user for explicit confirmation
        confirm = input(f"Send message to {recipient}? (y/n): ")
        if confirm.lower() != "y":
            return

    # Display confirmation with recipient name/number, message content, and media attachments
    print(f"Send message to {recipient}: {message}")

    # Log send operation to audit trail
    logging.info(f"Sent message to {recipient}: {message[:50]}")

    # Send message using wacli
    wacli.send_message(recipient, message)

def load_allowlist_from_config():
    # Load allowlist from config file (e.g., TOOLS.md)
    with open("TOOLS.md", "r") as f:
        allowlist = [line.strip() for line in f.readlines()]
    return allowlist

Verification

To verify that the fix worked, test the following scenarios:

  • Send a message to a recipient on the allowlist
  • Send a message to a recipient not on the allowlist
  • Attempt to send a bulk message to multiple recipients without explicit confirmation

Check the audit log to ensure that all send operations are logged correctly with redacted phone numbers and message content.

Extra Tips

  • Ensure that the allowlist is stored securely and not accessible to unauthorized users.
  • Consider implementing additional safety features, such as rate limiting or message content filtering.
  • Regularly review and update the SKILL.md instructions to ensure that they are accurate and effective.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#API routing#API middleware#SSR setup#ISR setup#authentication setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix wacli skill: add recipient allowlist and confirm-before-send enforcement [1 participants]