wewrite-stats
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to execute thewewrite statscommand and thefetch_stats.pyscript. These operations are required for the skill's primary function of data synchronization and analysis. - [EXTERNAL_DOWNLOADS]: The instructions recommend installing the
wewriteCLI tool usinguv tool install wewriteor by executing aninstall.shscript within the repository. These are standard procedures for installing functional command-line utilities. - [PROMPT_INJECTION]: The skill processes content fetched from the WeChat API (article metadata and engagement metrics). This creates a potential surface for indirect prompt injection if external data contains instructions intended to manipulate the agent.
- Ingestion points: External data from the WeChat Official Accounts API via
fetch_stats.py(SKILL.md). - Boundary markers: None identified; the instructions do not specify delimiters or warnings for the agent when processing external API data.
- Capability inventory: The skill is granted
Bash,Read,Write, andEditpermissions (SKILL.md). - Sanitization: The skill does not explicitly describe any sanitization or validation procedures for the ingested API content.
Audit Metadata