lov-wxmp-cracker

SUSPICIOUS: the visible skill description is narrow and plausible, and the install path appears mostly same-org and registry-backed, but the real skill logic is encrypted, decrypted at runtime, and not publicly reviewable. The main issue is transitive trust in hidden instructions rather than confirmed malicious behavior.

This fragment provides only an encrypted package manifest with AES-256-GCM metadata for referenced files; it contains no inspectable executable logic. While suspicious naming (“cracker”) and encrypted payloads reduce auditability and raise concern, there is insufficient evidence here to confirm malware, data theft, backdoors, or network exfiltration. A definitive assessment requires the decrypted contents of the referenced Python scripts and any loader/decryption mechanism.