github.com/penstemoncyananthuslogicgate5289/claude-whatsapp · main · scanned 0m ago · 1 config file

2 agent components (1 MCP server) in penstemoncyananthuslogicgate5289/claude-whatsapp: an installer lure (malware delivery pattern), 1 unvetted.

Components21 MCP server
High blast radius1credentials, shell or unvetted code
Credentials handed to agents0none seen
Not vetted1of 1 local servers, skills and plugins
ComponentWhereVerdictBlast radius
Installer lure (malware delivery pattern)Installer lure · any agent
README.mdmalware pattern
high
  • Archive committed in an agent bundle
  • README links to a committed installer
whatsappMCP server · Claude Code · stdionpm
.mcp.jsonnot vetted
medium
  • runs on the developer's machine with their files, network and shell
  • is not a registry package, so there is no verdict to check
What to do about it
  • Do not download or run anything from this repository. Its README sends readers to a committed installer and tells them to click past Windows' own warning; that is how the Agent Lure Stealer campaign (Nov 2026) delivers an infostealer. Real skills and MCP servers install from source, never from a ZIP.
  • Unvetted means we have no sandbox run for that exact package. Ask your agent to check before installing: claude mcp add killerskills -- npx -y vet-skills mcp
  • For a whole organization (every repo and laptop, rescanned daily, with removal across machines), see Discovery for teams.
Share: https://killerskills.ai/scan/github/penstemoncyananthuslogicgate5289/claude-whatsappRescan nowScan another