pywencai
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and installs the
pywencailibrary from the Python Package Index (PyPI) and references a public repository on GitHub. - [COMMAND_EXECUTION]: Provides instructions for the user to execute shell commands to install and upgrade dependencies using
pip. - [CREDENTIALS_UNSAFE]: Manages sensitive session cookies required for API authentication. The skill explicitly guides users to manage these via environment variables (
WENCAI_COOKIE) or local files, which is a secure alternative to hardcoding. - [DYNAMIC_EXECUTION]: The
pywencailibrary requires a Node.js environment to execute JavaScript code at runtime, which is used to generate the necessary security tokens for the Wencai platform. - [PROMPT_INJECTION]: The skill ingests natural language query results from an external web service and provides the capability to write this data to the local file system (Excel).
- Ingestion points: External data retrieved from
iwencai.comvia thepywencai.getfunction. - Boundary markers: Absent; data from the external source is processed as structured objects without explicit delimiters.
- Capability inventory: Local file system write access via
pandas.ExcelWriterin provided examples. - Sanitization: No specific sanitization or validation of the API response data is implemented before file output.
Audit Metadata