wps-core-api
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill acts as a legitimate documentation resource for WPS Office macro development. It contains technical code snippets for Range manipulation, worksheet management, and application settings. No signs of obfuscation, hardcoded credentials, or unauthorized network operations were identified.
- [PROMPT_INJECTION]: The skill provides instructions for reading data and formulas from worksheet cells, which serves as a potential ingestion point for indirect prompt injection attacks. 1. Ingestion points: Worksheet data is accessed via ws.Range().Value2 and ws.Range().Formula as shown in SKILL.md. 2. Boundary markers: The provided documentation does not include recommendations for using delimiters or boundary markers to isolate read content. 3. Capability inventory: The skill facilitates broad spreadsheet control, including the ability to write data, delete worksheets, and suppress user-facing application alerts using Application.DisplayAlerts = false. 4. Sanitization: There are no instructions for sanitizing or validating data read from external workbooks before it is processed by an agent.
Audit Metadata