From c0d5025a72cdabc6371f00a7342c839741427714 Mon Sep 17 00:00:00 2001
From: teknium1 <127238744+teknium1@users.noreply.github.com>
Date: Sat, 26 Sep 2026 11:20:25 -0700
Subject: [PATCH] chore(plugin-catalog): review disclosure for
 whatsapp-agent-platform

---
 plugin-catalog/whatsapp-agent-platform.yaml | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/plugin-catalog/whatsapp-agent-platform.yaml b/plugin-catalog/whatsapp-agent-platform.yaml
index 2b6bb75cad..10b939e23b 100644
--- a/plugin-catalog/whatsapp-agent-platform.yaml
+++ b/plugin-catalog/whatsapp-agent-platform.yaml
@@ -5,13 +5,17 @@ version: "0.1.1"
 requires_hermes: ">=0.21.4"
 title: WhatsApp Agent Platform
 description: >-
-  Community platform plugin (not affiliated with Meta or Nous Research) that connects a WhatsApp Agent to
-  Hermes through Meta's WhatsApp Agent Platform API (/agent/v1): long-poll inbound (no webhook or public URL),
-  text replies with WhatsApp formatting, read receipts and typing indicators, creator verification, and
-  cron/home-channel delivery to the agent's creator. Disclosure — sends the agent API key and message content
-  only to api.whatsapp.com (per WhatsApp's Third-Party Agents Terms, agent chats are not end-to-end encrypted);
-  stores the poll cursor, recent message ids and the creator's id under HERMES_HOME; no other network egress,
-  no telemetry, no self-update.
+  Community platform plugin (not affiliated with Meta or Nous Research) that connects a WhatsApp Agent
+  to Hermes through Meta's WhatsApp Agent Platform API (/agent/v1): long-poll inbound (no webhook or
+  public URL), text replies with WhatsApp formatting, read receipts and typing indicators, creator
+  verification, and cron/home-channel delivery to the agent's creator. Disclosure — sends the agent
+  API key and message content only to api.whatsapp.com (per WhatsApp's Third-Party Agents Terms, agent
+  chats are not end-to-end encrypted); stores the poll cursor, recent message ids and the creator's id
+  under HERMES_HOME; no other network egress, no telemetry, no self-update. By default only the
+  agent's creator (verified through Meta's API) can message Hermes;
+  WHATSAPP_AGENT_PLATFORM_ALLOWED_USERS or WHATSAPP_AGENT_PLATFORM_ALLOW_ALL_USERS widens that
+  explicitly. The agent API key is saved to the Hermes .env; the state file under HERMES_HOME is 0600
+  and never contains the key.
 maintainer: ahtishamdilawar
 tier: community
 category: platform