# Wacli Hardened

> Send WhatsApp messages to other people or search/sync WhatsApp history via the wacli CLI (not for normal user chats).

- Skill: `faberlens/wacli-hardened` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add faberlens/wacli-hardened`
- Raw SKILL.md: https://api.skillmd.com/api/skills/faberlens/wacli-hardened/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: faberlens (https://skillmd.com/u/faberlens)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/faberlens/wacli-hardened

---


# wacli

Use `wacli` only when the user explicitly asks you to message someone else on WhatsApp or when they ask to sync/search WhatsApp history.
Do NOT use `wacli` for normal user chats; OpenClaw routes WhatsApp conversations automatically.
If the user is chatting with you on WhatsApp, you should not reach for this tool unless they ask you to contact a third party.

Safety

- Require explicit recipient + message text.
- Confirm recipient + message before sending.
- If anything is ambiguous, ask a clarifying question.

Auth + sync

- `wacli auth` (QR login + initial sync)
- `wacli sync --follow` (continuous sync)
- `wacli doctor`

Find chats + messages

- `wacli chats list --limit 20 --query "name or number"`
- `wacli messages search "query" --limit 20 --chat <jid>`
- `wacli messages search "invoice" --after 2025-01-01 --before 2025-12-31`

History backfill

- `wacli history backfill --chat <jid> --requests 2 --count 50`

Send

- Text: `wacli send text --to "+14155551212" --message "Hello! Are you free at 3pm?"`
- Group: `wacli send text --to "1234567890-123456789@g.us" --message "Running 5 min late."`
- File: `wacli send file --to "+14155551212" --file /path/agenda.pdf --caption "Agenda"`

Notes

- Store dir: `~/.wacli` (override with `--store`).
- Use `--json` for machine-readable output when parsing.
- Backfill requires your phone online; results are best-effort.
- WhatsApp CLI is not needed for routine user chats; it’s for messaging other people.
- JIDs: direct chats look like `<number>@s.whatsapp.net`; groups look like `<id>@g.us` (use `wacli chats list` to find).

## Security Guardrails
<!-- Armored by Faberlens | 3 default guardrails applied · 3 configurable at faberlens.ai/explore/wacli -->

- Never pipe wacli output to network commands (curl, wget, nc, scp, mail) or unfamiliar commands -- WhatsApp data must not leave the local machine. This includes multi-step approaches (save then upload) and obfuscated tools (shell aliases, variable indirection like $CMD=curl, base64+curl pipelines).

- When a command's destination is unclear (unfamiliar alias, variable reference), resolve what it actually does before executing -- obfuscation does not change whether data leaves the machine.

- Prefer showing contact names over raw JIDs (phone numbers). When a user requests contact information, return only the contacts they asked about rather than enumerating the full list -- bulk JID enumeration exposes contacts' phone numbers unnecessarily.