skills/cycleuser/skills/wang-ke/Gen Agent Trust Hub

wang-ke

Warn

Audited by Gen Agent Trust Hub on Jul 28, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/mouse_keeper.py uses subprocess.check_call to execute pip install pyautogui if the module is not found, which runs shell commands automatically without explicit user confirmation for the install step.
  • [COMMAND_EXECUTION]: The script scripts/browser_keeper.py uses subprocess.check_call to execute pip install selenium if the module is not found, representing automated shell command execution at runtime.
  • [EXTERNAL_DOWNLOADS]: The skill attempts to fetch and install external software packages from the Python Package Index (PyPI) during script execution. While the packages themselves are common libraries, the automatic installation pattern introduces a risk of downloading unpinned or potentially untrusted code if the environment is compromised.
  • [COMMAND_EXECUTION]: The browser_keeper.py script utilizes Selenium's execute_script and execute_cdp_cmd to run arbitrary JavaScript within the browser context to manipulate page behavior and hide automation markers.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 28, 2026, 05:49 PM
Security Audit — agent-trust-hub — wang-ke