Wps Skill

• Analyzed: May 12, 2026, 4:14 AM
• Findings: 1
• Version: 1.3.0
• Hash: b1f9bd5aa2b4ce9838bbbb7ea69d1569a8767ba5150d1273ad4001c730ce129b
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is classified as suspicious due to multiple critical vulnerabilities that could lead to Remote Code Execution (RCE) and arbitrary file system access via prompt injection. Specifically, the `scripts/main.py` script directly passes unsanitized user input to `pyautogui.typewrite` (allowing arbitrary keystroke injection into any active application) and `subprocess.Popen` (creating shell injection vulnerabilities). Additionally, user-controlled file paths are used in `os.path.join` without proper sanitization, leading to path traversal risks. The `SKILL.md` document acknowledges some of these risks but the code does not mitigate them, and sensitive API credentials (`app_id`, `app_secret`) are stored in plain text in `config.json`.