wassette

The material explicitly states that no keys or environment variables are required, and there is no indication of token collection, storage, or exfiltration, so credential abuse exposure appears low.

No remote endpoints are declared, and the material does not describe network sync, telemetry, or data upload behavior; based on the available information, no explicit data egress path is evident.

Its core function is to execute WebAssembly components as a runtime, which is a typical local code-execution capability. This is an inherent property of such tools; attention should be paid to available host capabilities and sandbox boundaries, but this alone does not justify a high-risk rating.

As a runtime tool, it may access local files or other host resources depending on component permissions, but the provided material does not specify the exact read/write scope. There is no clear evidence of overbroad access beyond its stated purpose, though least-privilege deployment is still advisable.

The source is a Microsoft GitHub open-source repository under the MIT license with relatively strong community adoption (910 stars), providing good auditability and source credibility. Although maintenance status is unknown, the available positive signals materially lower the supply-chain risk.