wps-mail-merge
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the shell to install necessary Python dependencies (
python-docxandopenpyxl) via pip. This is a standard procedure for enabling the required functionality for processing Word and Excel files. - [EXTERNAL_DOWNLOADS]: The skill downloads and installs standard, widely-used libraries (
python-docx,openpyxl) from the official Python Package Index (PyPI). These are trusted libraries for document and spreadsheet manipulation. - [DATA_EXPOSURE]: The skill reads local template files (.docx) and data sources (.xlsx, .csv) provided by the user to perform the merge operation. The output is saved locally in a user-defined or default directory (
./merged_output/). No network exfiltration or unauthorized data access was detected. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Excel or CSV files and interpolates it into Word templates. While this creates a surface for indirect injection (e.g., if the generated document is later processed by another AI), the current implementation is focused on document generation and includes regex-based sanitization for output filenames to prevent path traversal or filesystem issues.
Audit Metadata