gkt-node 3.3.0

package/assets/.agent/skills/vulnerability-scanner/scripts/security_scan.py

@@ -0,0 +1,458 @@
+#!/usr/bin/env python3
+"""
+Skill: vulnerability-scanner
+Script: security_scan.py
+Purpose: Validate that security principles from SKILL.md are applied correctly
+Usage: python security_scan.py <project_path> [--scan-type all|deps|secrets|patterns|config]
+Output: JSON with validation findings
+
+This script verifies:
+1. Dependencies - Supply chain security (OWASP A03)
+2. Secrets - No hardcoded credentials (OWASP A04)
+3. Code Patterns - Dangerous patterns identified (OWASP A05)
+4. Configuration - Security settings validated (OWASP A02)
+"""
+import subprocess
+import json
+import os
+import sys
+import re
+import argparse
+from pathlib import Path
+from typing import Dict, List, Any
+from datetime import datetime
+
+# Fix Windows console encoding for Unicode output
+try:
+    sys.stdout.reconfigure(encoding='utf-8', errors='replace')
+    sys.stderr.reconfigure(encoding='utf-8', errors='replace')
+except AttributeError:
+    pass  # Python < 3.7
+
+
+# ============================================================================
+#  CONFIGURATION
+# ============================================================================
+
+SECRET_PATTERNS = [
+    # API Keys & Tokens
+    (r'api[_-]?key\s*[=:]\s*["\'][^"\']{10,}["\']', "API Key", "high"),
+    (r'token\s*[=:]\s*["\'][^"\']{10,}["\']', "Token", "high"),
+    (r'bearer\s+[a-zA-Z0-9\-_.]+', "Bearer Token", "critical"),
+    
+    # Cloud Credentials
+    (r'AKIA[0-9A-Z]{16}', "AWS Access Key", "critical"),
+    (r'aws[_-]?secret[_-]?access[_-]?key\s*[=:]\s*["\'][^"\']+["\']', "AWS Secret", "critical"),
+    (r'AZURE[_-]?[A-Z_]+\s*[=:]\s*["\'][^"\']+["\']', "Azure Credential", "critical"),
+    (r'GOOGLE[_-]?[A-Z_]+\s*[=:]\s*["\'][^"\']+["\']', "GCP Credential", "critical"),
+    
+    # Database & Connections
+    (r'password\s*[=:]\s*["\'][^"\']{4,}["\']', "Password", "high"),
+    (r'(mongodb|postgres|mysql|redis):\/\/[^\s"\']+', "Database Connection String", "critical"),
+    
+    # Private Keys
+    (r'-----BEGIN\s+(RSA|PRIVATE|EC)\s+KEY-----', "Private Key", "critical"),
+    (r'ssh-rsa\s+[A-Za-z0-9+/]+', "SSH Key", "critical"),
+    
+    # JWT
+    (r'eyJ[A-Za-z0-9-_]+\.eyJ[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+', "JWT Token", "high"),
+]
+
+DANGEROUS_PATTERNS = [
+    # Injection risks
+    (r'eval\s*\(', "eval() usage", "critical", "Code Injection risk"),
+    (r'exec\s*\(', "exec() usage", "critical", "Code Injection risk"),
+    (r'new\s+Function\s*\(', "Function constructor", "high", "Code Injection risk"),
+    (r'child_process\.exec\s*\(', "child_process.exec", "high", "Command Injection risk"),
+    (r'subprocess\.call\s*\([^)]*shell\s*=\s*True', "subprocess with shell=True", "high", "Command Injection risk"),
+    
+    # XSS risks
+    (r'dangerouslySetInnerHTML', "dangerouslySetInnerHTML", "high", "XSS risk"),
+    (r'\.innerHTML\s*=', "innerHTML assignment", "medium", "XSS risk"),
+    (r'document\.write\s*\(', "document.write", "medium", "XSS risk"),
+    
+    # SQL Injection indicators
+    (r'["\'][^"\']*\+\s*[a-zA-Z_]+\s*\+\s*["\'].*(?:SELECT|INSERT|UPDATE|DELETE)', "SQL String Concat", "critical", "SQL Injection risk"),
+    (r'f"[^"]*(?:SELECT|INSERT|UPDATE|DELETE)[^"]*\{', "SQL f-string", "critical", "SQL Injection risk"),
+    
+    # Insecure configurations
+    (r'verify\s*=\s*False', "SSL Verify Disabled", "high", "MITM risk"),
+    (r'--insecure', "Insecure flag", "medium", "Security disabled"),
+    (r'disable[_-]?ssl', "SSL Disabled", "high", "MITM risk"),
+    
+    # Unsafe deserialization
+    (r'pickle\.loads?\s*\(', "pickle usage", "high", "Deserialization risk"),
+    (r'yaml\.load\s*\([^)]*\)(?!\s*,\s*Loader)', "Unsafe YAML load", "high", "Deserialization risk"),
+]
+
+SKIP_DIRS = {'node_modules', '.git', 'dist', 'build', '__pycache__', '.venv', 'venv', '.next'}
+CODE_EXTENSIONS = {'.js', '.ts', '.jsx', '.tsx', '.py', '.go', '.java', '.rb', '.php'}
+CONFIG_EXTENSIONS = {'.json', '.yaml', '.yml', '.toml', '.env', '.env.local', '.env.development'}
+
+
+# ============================================================================
+#  SCANNING FUNCTIONS
+# ============================================================================
+
+def scan_dependencies(project_path: str) -> Dict[str, Any]:
+    """
+    Validate supply chain security (OWASP A03).
+    Checks: npm audit, lock file presence, dependency age.
+    """
+    results = {"tool": "dependency_scanner", "findings": [], "status": "[OK] Secure"}
+    
+    # Check for lock files
+    lock_files = {
+        "npm": ["package-lock.json", "npm-shrinkwrap.json"],
+        "yarn": ["yarn.lock"],
+        "pnpm": ["pnpm-lock.yaml"],
+        "pip": ["requirements.txt", "Pipfile.lock", "poetry.lock"],
+    }
+    
+    found_locks = []
+    missing_locks = []
+    
+    for manager, files in lock_files.items():
+        pkg_file = "package.json" if manager in ["npm", "yarn", "pnpm"] else "setup.py"
+        pkg_path = Path(project_path) / pkg_file
+        
+        if pkg_path.exists() or (manager == "pip" and (Path(project_path) / "requirements.txt").exists()):
+            has_lock = any((Path(project_path) / f).exists() for f in files)
+            if has_lock:
+                found_locks.append(manager)
+            else:
+                missing_locks.append(manager)
+                results["findings"].append({
+                    "type": "Missing Lock File",
+                    "severity": "high",
+                    "message": f"{manager}: No lock file found. Supply chain integrity at risk."
+                })
+    
+    # Run npm audit if applicable
+    if (Path(project_path) / "package.json").exists():
+        try:
+            result = subprocess.run(
+                ["npm", "audit", "--json"],
+                cwd=project_path,
+                capture_output=True,
+                text=True,
+                timeout=60
+            )
+            
+            try:
+                audit_data = json.loads(result.stdout)
+                vulnerabilities = audit_data.get("vulnerabilities", {})
+                
+                severity_count = {"critical": 0, "high": 0, "moderate": 0, "low": 0}
+                for vuln in vulnerabilities.values():
+                    sev = vuln.get("severity", "low").lower()
+                    if sev in severity_count:
+                        severity_count[sev] += 1
+                
+                if severity_count["critical"] > 0:
+                    results["status"] = "[!!] Critical vulnerabilities"
+                    results["findings"].append({
+                        "type": "npm audit",
+                        "severity": "critical",
+                        "message": f"{severity_count['critical']} critical vulnerabilities in dependencies"
+                    })
+                elif severity_count["high"] > 0:
+                    results["status"] = "[!] High vulnerabilities"
+                    results["findings"].append({
+                        "type": "npm audit",
+                        "severity": "high",
+                        "message": f"{severity_count['high']} high severity vulnerabilities"
+                    })
+                
+                results["npm_audit"] = severity_count
+                
+            except json.JSONDecodeError:
+                pass
+                
+        except (FileNotFoundError, subprocess.TimeoutExpired):
+            pass
+    
+    if not results["findings"]:
+        results["status"] = "[OK] Supply chain checks passed"
+    
+    return results
+
+
+def scan_secrets(project_path: str) -> Dict[str, Any]:
+    """
+    Validate no hardcoded secrets (OWASP A04).
+    Checks: API keys, tokens, passwords, cloud credentials.
+    """
+    results = {
+        "tool": "secret_scanner",
+        "findings": [],
+        "status": "[OK] No secrets detected",
+        "scanned_files": 0,
+        "by_severity": {"critical": 0, "high": 0, "medium": 0}
+    }
+    
+    for root, dirs, files in os.walk(project_path):
+        dirs[:] = [d for d in dirs if d not in SKIP_DIRS]
+        
+        for file in files:
+            ext = Path(file).suffix.lower()
+            if ext not in CODE_EXTENSIONS and ext not in CONFIG_EXTENSIONS:
+                continue
+                
+            filepath = Path(root) / file
+            results["scanned_files"] += 1
+            
+            try:
+                with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
+                    content = f.read()
+                    
+                    for pattern, secret_type, severity in SECRET_PATTERNS:
+                        matches = re.findall(pattern, content, re.IGNORECASE)
+                        if matches:
+                            results["findings"].append({
+                                "file": str(filepath.relative_to(project_path)),
+                                "type": secret_type,
+                                "severity": severity,
+                                "count": len(matches)
+                            })
+                            results["by_severity"][severity] += len(matches)
+                            
+            except Exception:
+                pass
+    
+    if results["by_severity"]["critical"] > 0:
+        results["status"] = "[!!] CRITICAL: Secrets exposed!"
+    elif results["by_severity"]["high"] > 0:
+        results["status"] = "[!] HIGH: Secrets found"
+    elif sum(results["by_severity"].values()) > 0:
+        results["status"] = "[?] Potential secrets detected"
+    
+    # Limit findings for output
+    results["findings"] = results["findings"][:15]
+    
+    return results
+
+
+def scan_code_patterns(project_path: str) -> Dict[str, Any]:
+    """
+    Validate dangerous code patterns (OWASP A05).
+    Checks: Injection risks, XSS, unsafe deserialization.
+    """
+    results = {
+        "tool": "pattern_scanner",
+        "findings": [],
+        "status": "[OK] No dangerous patterns",
+        "scanned_files": 0,
+        "by_category": {}
+    }
+    
+    for root, dirs, files in os.walk(project_path):
+        dirs[:] = [d for d in dirs if d not in SKIP_DIRS]
+        
+        for file in files:
+            ext = Path(file).suffix.lower()
+            if ext not in CODE_EXTENSIONS:
+                continue
+                
+            filepath = Path(root) / file
+            results["scanned_files"] += 1
+            
+            try:
+                with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
+                    lines = f.readlines()
+                    
+                    for line_num, line in enumerate(lines, 1):
+                        for pattern, name, severity, category in DANGEROUS_PATTERNS:
+                            if re.search(pattern, line, re.IGNORECASE):
+                                results["findings"].append({
+                                    "file": str(filepath.relative_to(project_path)),
+                                    "line": line_num,
+                                    "pattern": name,
+                                    "severity": severity,
+                                    "category": category,
+                                    "snippet": line.strip()[:80]
+                                })
+                                results["by_category"][category] = results["by_category"].get(category, 0) + 1
+                                
+            except Exception:
+                pass
+    
+    critical_count = sum(1 for f in results["findings"] if f["severity"] == "critical")
+    high_count = sum(1 for f in results["findings"] if f["severity"] == "high")
+    
+    if critical_count > 0:
+        results["status"] = f"[!!] CRITICAL: {critical_count} dangerous patterns"
+    elif high_count > 0:
+        results["status"] = f"[!] HIGH: {high_count} risky patterns"
+    elif results["findings"]:
+        results["status"] = "[?] Some patterns need review"
+    
+    # Limit findings
+    results["findings"] = results["findings"][:20]
+    
+    return results
+
+
+def scan_configuration(project_path: str) -> Dict[str, Any]:
+    """
+    Validate security configuration (OWASP A02).
+    Checks: Security headers, CORS, debug modes.
+    """
+    results = {
+        "tool": "config_scanner",
+        "findings": [],
+        "status": "[OK] Configuration secure",
+        "checks": {}
+    }
+    
+    # Check common config files for issues
+    config_issues = [
+        (r'"DEBUG"\s*:\s*true', "Debug mode enabled", "high"),
+        (r'debug\s*=\s*True', "Debug mode enabled", "high"),
+        (r'NODE_ENV.*development', "Development mode in config", "medium"),
+        (r'"CORS_ALLOW_ALL".*true', "CORS allow all origins", "high"),
+        (r'"Access-Control-Allow-Origin".*\*', "CORS wildcard", "high"),
+        (r'allowCredentials.*true.*origin.*\*', "Dangerous CORS combo", "critical"),
+    ]
+    
+    for root, dirs, files in os.walk(project_path):
+        dirs[:] = [d for d in dirs if d not in SKIP_DIRS]
+        
+        for file in files:
+            ext = Path(file).suffix.lower()
+            if ext not in CONFIG_EXTENSIONS and file not in ['next.config.js', 'webpack.config.js', '.eslintrc.js']:
+                continue
+                
+            filepath = Path(root) / file
+            
+            try:
+                with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
+                    content = f.read()
+                    
+                    for pattern, issue, severity in config_issues:
+                        if re.search(pattern, content, re.IGNORECASE):
+                            results["findings"].append({
+                                "file": str(filepath.relative_to(project_path)),
+                                "issue": issue,
+                                "severity": severity
+                            })
+                            
+            except Exception:
+                pass
+    
+    # Check for security header configurations
+    header_files = ["next.config.js", "next.config.mjs", "middleware.ts", "nginx.conf"]
+    for hf in header_files:
+        hf_path = Path(project_path) / hf
+        if hf_path.exists():
+            results["checks"]["security_headers_config"] = True
+            break
+    else:
+        results["checks"]["security_headers_config"] = False
+        results["findings"].append({
+            "issue": "No security headers configuration found",
+            "severity": "medium",
+            "recommendation": "Configure CSP, HSTS, X-Frame-Options headers"
+        })
+    
+    if any(f["severity"] == "critical" for f in results["findings"]):
+        results["status"] = "[!!] CRITICAL: Configuration issues"
+    elif any(f["severity"] == "high" for f in results["findings"]):
+        results["status"] = "[!] HIGH: Configuration review needed"
+    elif results["findings"]:
+        results["status"] = "[?] Minor configuration issues"
+    
+    return results
+
+
+# ============================================================================
+#  MAIN
+# ============================================================================
+
+def run_full_scan(project_path: str, scan_type: str = "all") -> Dict[str, Any]:
+    """Execute security validation scans."""
+    
+    report = {
+        "project": project_path,
+        "timestamp": datetime.now().isoformat(),
+        "scan_type": scan_type,
+        "scans": {},
+        "summary": {
+            "total_findings": 0,
+            "critical": 0,
+            "high": 0,
+            "overall_status": "[OK] SECURE"
+        }
+    }
+    
+    scanners = {
+        "deps": ("dependencies", scan_dependencies),
+        "secrets": ("secrets", scan_secrets),
+        "patterns": ("code_patterns", scan_code_patterns),
+        "config": ("configuration", scan_configuration),
+    }
+    
+    for key, (name, scanner) in scanners.items():
+        if scan_type == "all" or scan_type == key:
+            result = scanner(project_path)
+            report["scans"][name] = result
+            
+            findings_count = len(result.get("findings", []))
+            report["summary"]["total_findings"] += findings_count
+            
+            for finding in result.get("findings", []):
+                sev = finding.get("severity", "low")
+                if sev == "critical":
+                    report["summary"]["critical"] += 1
+                elif sev == "high":
+                    report["summary"]["high"] += 1
+    
+    # Determine overall status
+    if report["summary"]["critical"] > 0:
+        report["summary"]["overall_status"] = "[!!] CRITICAL ISSUES FOUND"
+    elif report["summary"]["high"] > 0:
+        report["summary"]["overall_status"] = "[!] HIGH RISK ISSUES"
+    elif report["summary"]["total_findings"] > 0:
+        report["summary"]["overall_status"] = "[?] REVIEW RECOMMENDED"
+    
+    return report
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Validate security principles from vulnerability-scanner skill"
+    )
+    parser.add_argument("project_path", nargs="?", default=".", help="Project directory to scan")
+    parser.add_argument("--scan-type", choices=["all", "deps", "secrets", "patterns", "config"],
+                        default="all", help="Type of scan to run")
+    parser.add_argument("--output", choices=["json", "summary"], default="json",
+                        help="Output format")
+    
+    args = parser.parse_args()
+    
+    if not os.path.isdir(args.project_path):
+        print(json.dumps({"error": f"Directory not found: {args.project_path}"}))
+        sys.exit(1)
+    
+    result = run_full_scan(args.project_path, args.scan_type)
+    
+    if args.output == "summary":
+        print(f"\n{'='*60}")
+        print(f"Security Scan: {result['project']}")
+        print(f"{'='*60}")
+        print(f"Status: {result['summary']['overall_status']}")
+        print(f"Total Findings: {result['summary']['total_findings']}")
+        print(f"  Critical: {result['summary']['critical']}")
+        print(f"  High: {result['summary']['high']}")
+        print(f"{'='*60}\n")
+        
+        for scan_name, scan_result in result['scans'].items():
+            print(f"\n{scan_name.upper()}: {scan_result['status']}")
+            for finding in scan_result.get('findings', [])[:5]:
+                print(f"  - {finding}")
+    else:
+        print(json.dumps(result, indent=2))
+
+
+if __name__ == "__main__":
+    main()

package/assets/.agent/skills/whatsapp-automation/SKILL.md

@@ -0,0 +1,214 @@
+---
+name: whatsapp-automation
+description: "Automate WhatsApp Business tasks via Rube MCP (Composio): send messages, manage templates, upload media, and handle contacts. Always search tools first for current schemas."
+requires:
+  mcp: [rube]
+---
+
+# WhatsApp Business Automation via Rube MCP
+
+Automate WhatsApp Business operations through Composio's WhatsApp toolkit via Rube MCP.
+
+## Prerequisites
+
+- Rube MCP must be connected (RUBE_SEARCH_TOOLS available)
+- Active WhatsApp connection via `RUBE_MANAGE_CONNECTIONS` with toolkit `whatsapp`
+- Always call `RUBE_SEARCH_TOOLS` first to get current tool schemas
+- WhatsApp Business API account required (not regular WhatsApp)
+
+## Setup
+
+**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API keys needed — just add the endpoint and it works.
+
+
+1. Verify Rube MCP is available by confirming `RUBE_SEARCH_TOOLS` responds
+2. Call `RUBE_MANAGE_CONNECTIONS` with toolkit `whatsapp`
+3. If connection is not ACTIVE, follow the returned auth link to complete WhatsApp Business setup
+4. Confirm connection status shows ACTIVE before running any workflows
+
+## Core Workflows
+
+### 1. Send a Text Message
+
+**When to use**: User wants to send a text message to a WhatsApp contact
+
+**Tool sequence**:
+1. `WHATSAPP_GET_PHONE_NUMBERS` - List available business phone numbers [Prerequisite]
+2. `WHATSAPP_SEND_MESSAGE` - Send a text message [Required]
+
+**Key parameters**:
+- `to`: Recipient phone number in international format (e.g., '+14155551234')
+- `body`: Message text content
+- `phone_number_id`: Business phone number ID to send from
+
+**Pitfalls**:
+- Phone numbers must be in international E.164 format with country code
+- Messages outside the 24-hour window require approved templates
+- The 24-hour window starts when the customer last messaged you
+- Business-initiated conversations require template messages first
+
+### 2. Send Template Messages
+
+**When to use**: User wants to send pre-approved template messages for outbound communication
+
+**Tool sequence**:
+1. `WHATSAPP_GET_MESSAGE_TEMPLATES` - List available templates [Prerequisite]
+2. `WHATSAPP_GET_TEMPLATE_STATUS` - Check template approval status [Optional]
+3. `WHATSAPP_SEND_TEMPLATE_MESSAGE` - Send the template message [Required]
+
+**Key parameters**:
+- `template_name`: Name of the approved template
+- `language_code`: Template language (e.g., 'en_US')
+- `to`: Recipient phone number
+- `components`: Template variable values and parameters
+
+**Pitfalls**:
+- Templates must be approved by Meta before use
+- Template variables must match the expected count and format
+- Sending unapproved or rejected templates returns errors
+- Language code must match an approved translation of the template
+
+### 3. Send Media Messages
+
+**When to use**: User wants to send images, documents, or other media
+
+**Tool sequence**:
+1. `WHATSAPP_UPLOAD_MEDIA` - Upload media to WhatsApp servers [Required]
+2. `WHATSAPP_SEND_MEDIA_BY_ID` - Send media using the uploaded media ID [Required]
+   OR
+3. `WHATSAPP_SEND_MEDIA` - Send media using a public URL [Alternative]
+
+**Key parameters**:
+- `media_url`: Public URL of the media (for SEND_MEDIA)
+- `media_id`: ID from upload response (for SEND_MEDIA_BY_ID)
+- `type`: Media type ('image', 'document', 'audio', 'video', 'sticker')
+- `caption`: Optional caption for the media
+
+**Pitfalls**:
+- Uploaded media IDs are temporary and expire after a period
+- Media size limits vary by type (images: 5MB, videos: 16MB, documents: 100MB)
+- Supported formats: images (JPEG, PNG), videos (MP4, 3GPP), documents (PDF, etc.)
+- SEND_MEDIA requires a publicly accessible HTTPS URL
+
+### 4. Reply to Messages
+
+**When to use**: User wants to reply to an incoming WhatsApp message
+
+**Tool sequence**:
+1. `WHATSAPP_SEND_REPLY` - Send a reply to a specific message [Required]
+
+**Key parameters**:
+- `message_id`: ID of the message being replied to
+- `to`: Recipient phone number
+- `body`: Reply text content
+
+**Pitfalls**:
+- message_id must be from a message received within the 24-hour window
+- Replies appear as quoted messages in the conversation
+- The original message must still exist (not deleted) for the quote to display
+
+### 5. Manage Business Profile and Templates
+
+**When to use**: User wants to view or manage their WhatsApp Business profile
+
+**Tool sequence**:
+1. `WHATSAPP_GET_BUSINESS_PROFILE` - Get business profile details [Optional]
+2. `WHATSAPP_GET_PHONE_NUMBERS` - List registered phone numbers [Optional]
+3. `WHATSAPP_GET_PHONE_NUMBER` - Get details for a specific number [Optional]
+4. `WHATSAPP_CREATE_MESSAGE_TEMPLATE` - Create a new template [Optional]
+5. `WHATSAPP_GET_MESSAGE_TEMPLATES` - List all templates [Optional]
+
+**Key parameters**:
+- `phone_number_id`: Business phone number ID
+- `template_name`: Name for the new template
+- `category`: Template category (MARKETING, UTILITY, AUTHENTICATION)
+- `language`: Template language code
+
+**Pitfalls**:
+- New templates require Meta review before they can be used
+- Template names must be lowercase with underscores (no spaces)
+- Category affects pricing and approval criteria
+- Templates have specific formatting requirements for headers, body, and buttons
+
+### 6. Share Contacts
+
+**When to use**: User wants to send contact information via WhatsApp
+
+**Tool sequence**:
+1. `WHATSAPP_SEND_CONTACTS` - Send contact cards [Required]
+
+**Key parameters**:
+- `to`: Recipient phone number
+- `contacts`: Array of contact objects with name, phone, email details
+
+**Pitfalls**:
+- Contact objects must follow the WhatsApp Business API contact schema
+- At least a name field is required for each contact
+- Phone numbers in contacts should include country codes
+
+## Common Patterns
+
+### 24-Hour Messaging Window
+
+- Customers must message you first to open a conversation window
+- Within 24 hours of their last message, you can send free-form messages
+- After 24 hours, only approved template messages can be sent
+- Template messages can re-open the conversation window
+
+### Phone Number Resolution
+
+```
+1. Call WHATSAPP_GET_PHONE_NUMBERS
+2. Extract phone_number_id for your business number
+3. Use phone_number_id in all send operations
+```
+
+### Media Upload Flow
+
+```
+1. Call WHATSAPP_UPLOAD_MEDIA with the file
+2. Extract media_id from response
+3. Call WHATSAPP_SEND_MEDIA_BY_ID with media_id
+4. OR use WHATSAPP_SEND_MEDIA with a public URL directly
+```
+
+## Known Pitfalls
+
+**Phone Number Format**:
+- Always use E.164 format: +[country code][number] (e.g., '+14155551234')
+- Do not include dashes, spaces, or parentheses
+- Country code is required; local numbers without it will fail
+
+**Messaging Restrictions**:
+- Business-initiated messages require templates outside the 24-hour window
+- Template messages cost money per conversation
+- Rate limits apply per phone number and per account
+
+**Media Handling**:
+- Uploaded media expires; use promptly after upload
+- Media URLs must be publicly accessible HTTPS
+- Stickers have specific requirements (WebP format, 512x512 pixels)
+
+**Template Management**:
+- Template review can take up to 24 hours
+- Rejected templates need to be fixed and resubmitted
+- Template variables use double curly braces: {{1}}, {{2}}, etc.
+
+## Quick Reference
+
+| Task | Tool Slug | Key Params |
+|------|-----------|------------|
+| Send message | WHATSAPP_SEND_MESSAGE | to, body |
+| Send template | WHATSAPP_SEND_TEMPLATE_MESSAGE | template_name, to, language_code |
+| Upload media | WHATSAPP_UPLOAD_MEDIA | (file params) |
+| Send media by ID | WHATSAPP_SEND_MEDIA_BY_ID | media_id, to, type |
+| Send media by URL | WHATSAPP_SEND_MEDIA | media_url, to, type |
+| Reply to message | WHATSAPP_SEND_REPLY | message_id, to, body |
+| Send contacts | WHATSAPP_SEND_CONTACTS | to, contacts |
+| Get media | WHATSAPP_GET_MEDIA | media_id |
+| List phone numbers | WHATSAPP_GET_PHONE_NUMBERS | (none) |
+| Get phone number | WHATSAPP_GET_PHONE_NUMBER | phone_number_id |
+| Get business profile | WHATSAPP_GET_BUSINESS_PROFILE | phone_number_id |
+| Create template | WHATSAPP_CREATE_MESSAGE_TEMPLATE | template_name, category, language |
+| List templates | WHATSAPP_GET_MESSAGE_TEMPLATES | (none) |
+| Check template status | WHATSAPP_GET_TEMPLATE_STATUS | template_id |