No malicious or install-time attack surface was confirmed. User-invoked automation forwards WhatsApp content to the user-configured LLM provider and sends generated replies.
Static reason
No blocking static signals were detected.
Trigger
User runs replypilot start after interactive setup/login.
Impact
Configured provider receives conversation context; the package can send automated WhatsApp replies as its stated function.
Mechanism
WhatsApp reply automation through a configured LLM API.
Rationale
Source implements its declared, user-invoked WhatsApp/LLM automation with configurable endpoints and no hidden exfiltration, payload execution, or persistence. No install-time execution is present.
Evidence
package.jsondist/cli.jsdist/index.js.wwebjs_cache
Network endpoints4
localhost:1234/v1localhost:11434/v1localhost:8080/inferenceollama.com/v1