wps-jsa-macro
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill accepts user-provided input through the '[操作描述]' argument. This input is used to determine the logic of the generated macro. While any user-input field is a potential surface for injection, the skill's instructions strictly constrain the output to WPS JSA macro code, which reduces the risk of malicious instruction execution within the agent's own context.
- [COMMAND_EXECUTION]: The skill is permitted to use
WriteandEdittools to save the generated JavaScript macros to the local file system. This is consistent with the skill's stated purpose of helping users create automation scripts for WPS Office. - [DATA_EXPOSURE]: The provided API references and examples include common file paths like
/path/to/file.docxas placeholders. There are no patterns suggesting the harvesting or exfiltration of sensitive local data or credentials.
Audit Metadata