lov-wxmp-cracker
Fail
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill's primary logic and instructions are distributed in encrypted formats (
SKILL.md.enc,scripts/refresh_token.py.enc, andscripts/wcx_run.py.enc). The provided documentation states that these components are decrypted only in memory at runtime and are not written to the disk in plaintext. This intentionally prevents the security platform from inspecting the skill's behavior, API calls, or safety constraints. - [REMOTE_CODE_EXECUTION]: The installation and execution flow relies on tool runners
npxanduvxto download and run external packages (lovstudioandlovstudio-skill-helper). These tools are responsible for the decryption and execution of the hidden logic, introducing an unverified remote execution layer. - [COMMAND_EXECUTION]: The
SKILL.mdinstructions direct the user or agent to execute shell commands to modify the environment and decrypt skill components, which bypasses typical static analysis boundaries for AI skills. - [EXTERNAL_DOWNLOADS]: The skill's operation depends on fetching encrypted blobs and remote helper tools from vendor-controlled registries at runtime, creating a persistent dependency on external, unvetted infrastructure for core functionality.
Recommendations
- AI detected serious security threats
Audit Metadata