skills/oaker-io/wewrite/wewrite-stats/Gen Agent Trust Hub

wewrite-stats

Pass

Audited by Gen Agent Trust Hub on Jul 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute the wewrite stats command and the fetch_stats.py script. These operations are required for the skill's primary function of data synchronization and analysis.
  • [EXTERNAL_DOWNLOADS]: The instructions recommend installing the wewrite CLI tool using uv tool install wewrite or by executing an install.sh script within the repository. These are standard procedures for installing functional command-line utilities.
  • [PROMPT_INJECTION]: The skill processes content fetched from the WeChat API (article metadata and engagement metrics). This creates a potential surface for indirect prompt injection if external data contains instructions intended to manipulate the agent.
  • Ingestion points: External data from the WeChat Official Accounts API via fetch_stats.py (SKILL.md).
  • Boundary markers: None identified; the instructions do not specify delimiters or warnings for the agent when processing external API data.
  • Capability inventory: The skill is granted Bash, Read, Write, and Edit permissions (SKILL.md).
  • Sanitization: The skill does not explicitly describe any sanitization or validation procedures for the ingested API content.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 21, 2026, 08:20 AM
Security Audit — agent-trust-hub — wewrite-stats