wiggle-claude-skill
Warn
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to download and install external code from an unverified GitHub repository (talknerdytome-labs/wiggle-claude-skill). This bypasses the ability to statically analyze the functional code of the skill.
- [COMMAND_EXECUTION]: The skill provides specific bash commands (grep, npx) and explicitly instructs the agent to execute them. It specifically references the '!' command prefix to run these commands silently in the background, reducing user oversight and manual confirmation.
- [REMOTE_CODE_EXECUTION]: The 'npx skills add' command downloads and executes a remote package. Since the source is an untrusted third-party repository, this constitutes unverified remote code execution.
- [PROMPT_INJECTION]: The skill uses imperative instructions to override standard agent behavior and force the execution of external scripts and installation tools. It additionally defines a workflow for processing external SVG files, creating an indirect injection surface.
- Ingestion point: SVG logo inputs in SKILL.md
- Boundary markers: None present
- Capability inventory: npx (installation), file-write (MP4/GIF export)
- Sanitization: None present
Audit Metadata