Skills
skills/trywpm/skills/wpm/Gen Agent Trust Hub

wpm

Fail

Audited by Gen Agent Trust Hub on Feb 16, 2026

Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • Remote Code Execution (CRITICAL): The skill instructs users to install the tool by piping a remote script directly into a shell interpreter for both Unix and Windows systems.
  • Evidence (Unix): curl -fsSL https://wpm.so/install | bash in SKILL.md.
  • Evidence (Windows): irm wpm.so/install.ps1 | iex in SKILL.md.
  • Risk: This pattern allows the host at wpm.so to execute arbitrary commands on the user's machine. Since wpm.so is not a recognized trusted source, this is a critical vulnerability.
  • External Downloads (HIGH): The skill relies on software and installation scripts hosted on a non-trusted domain (wpm.so). There is no verification of the script's integrity (e.g., checksums) before execution.
  • Command Execution (LOW): The skill manages a local CLI tool (wpm). While this is the intended purpose, the combination of a custom CLI and an insecure installation method increases the overall risk profile.
Recommendations
  • CRITICAL: Downloads and executes remote code from untrusted source(s): https://wpm.so/install - DO NOT USE
  • AI detected serious security threats
Audit Metadata
Risk Level
CRITICAL
Analyzed
Feb 16, 2026, 10:45 AM