lov-wxmp-cracker
Warn
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: MEDIUMOBFUSCATIONDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [OBFUSCATION]: The skill stores its executable logic and extended documentation in encrypted files (
SKILL.md.enc,scripts/refresh_token.py.enc, andscripts/wcx_run.py.enc) using AES-256-GCM. This prevents static review of the code's behavior, as the contents are hidden from plain-text inspection. - [DYNAMIC_EXECUTION]: The skill employs a runtime decryption and execution mechanism, where the
lovstudio-skill-helpertool is used to decrypt the encrypted blobs and load the scripts into the agent's environment. This results in the execution of code that cannot be verified before runtime. - [REMOTE_CODE_EXECUTION]: The provided operational instructions rely on
npxanduvxto fetch and execute packages (lovstudioandlovstudio-skill-helper) from public registries. This introduces external code into the execution environment that is not shipped with the skill itself. - [EXTERNAL_DOWNLOADS]: The skill is designed to fetch additional encrypted distribution packages and decryption tools from vendor-controlled external sources during the initialization and execution phases.
Audit Metadata