wps-airpage
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs local command execution to automate the setup of its environment, including running
npm installfor dependencies andnpx playwright installto download browser drivers required for authentication extraction. - [EXTERNAL_DOWNLOADS]: The skill fetches software packages from the official NPM registry and browser binaries from Playwright's distribution servers. These actions are triggered during installation or when first using the browser-based authentication feature.
- [DATA_EXFILTRATION]: The skill communicates with
365.kdocs.cnto perform document management tasks such as searching, reading, and editing content. It stores sensitive session information (cookies and CSRF tokens) locally in~/.claude/secrets/wps365.jsonusing restricted file permissions (0600) to ensure they are not accessible by other local users. - [SAFE]: The identified behaviors are necessary for the skill's primary function of automating a web-based document platform. The code uses standard practices for local secret management and interacts only with well-known services and the vendor's own infrastructure.
Audit Metadata