skills/wlzh/skills/wespy-fetcher/Gen Agent Trust Hub

wespy-fetcher

Fail

Audited by Gen Agent Trust Hub on Mar 1, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The script scripts/wespy_cli.py is designed to automatically clone an external repository from https://github.com/tianchangNorth/WeSpy.git to the user's local directory (~/Documents/QNSZ/project/WeSpy) if it is not already present.
  • [REMOTE_CODE_EXECUTION]: The skill performs dynamic code loading by adding the freshly cloned repository to the Python search path (sys.path) and importing its main entry point (wespy.main.main). This enables the execution of external, unverified code at runtime.
  • [COMMAND_EXECUTION]: The skill uses the subprocess.run module to execute system-level git clone commands to manage its external dependencies.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Mar 1, 2026, 04:28 PM