wiggle-claude-skill
Warn
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill initiates the installation of additional code from an external GitHub repository (talknerdytome-labs/wiggle-claude-skill).
- [COMMAND_EXECUTION]: Contains shell instructions for environment discovery and installation of system-level dependencies (brew, apt-get) and Python packages.
- [INDIRECT_PROMPT_INJECTION]: Ingestion points: Processes external logo images (PNG, SVG, JPG). Boundary markers: No delimiters or warnings are used when processing input files. Capability inventory: Performs shell command execution for installation and file system writes for rendering outputs. Sanitization: Lacks explicit validation or sanitization steps for input file formats like SVG which can harbor malicious payloads.
- [REMOTE_CODE_EXECUTION]: Uses the npx package runner to install and potentially execute code from a remote repository.
Audit Metadata