SKILL.md — grille-wmi
What This Skill Does
Query WMI/CIM classes on the local Windows machine for hardware, OS, BIOS, network, and system inventory data. Returns structured results as key-value pairs (single instance) or tables (multiple instances).
Tool
wmi_query — query any WMI class listed in allowed_classes (grille.toml).
Parameters
| Parameter |
Required |
Description |
class |
Yes |
WMI class name, e.g. Win32_Processor |
filter |
No |
WQL WHERE clause (without WHERE), e.g. DriveType=3 |
properties |
No |
Array of property names to return (omit = all) |
Safe Class Set (initial allowlist)
| Class |
What It Returns |
Win32_OperatingSystem |
OS version, build, uptime, memory stats |
Win32_ComputerSystem |
Hostname, domain membership, manufacturer, model, RAM |
Win32_Processor |
CPU name, cores, speed, socket, architecture |
Win32_PhysicalMemory |
RAM slot layout, capacity per DIMM, speed, manufacturer |
Win32_DiskDrive |
Physical disk model, size, interface, firmware |
Win32_LogicalDisk |
Drive letters, filesystem, free/total space |
Win32_NetworkAdapterConfiguration |
IP address, subnet, gateway, DNS, DHCP |
Win32_BIOS |
BIOS version, release date, serial number |
Win32_StartupCommand |
Startup entries (useful for security audits) |
Win32_BaseBoard |
Motherboard manufacturer, model, serial number |
Win32_SystemEnclosure |
Chassis type (desktop/laptop/server), serial number |
Common Patterns
Hardware inventory
class: Win32_Processor
properties: ["Name", "NumberOfCores", "NumberOfLogicalProcessors", "MaxClockSpeed"]
RAM layout
class: Win32_PhysicalMemory
properties: ["BankLabel", "Capacity", "Speed", "Manufacturer"]
Fixed drives only
class: Win32_LogicalDisk
filter: DriveType=3
properties: ["DeviceID", "Size", "FreeSpace", "FileSystem", "VolumeName"]
Active network adapters
class: Win32_NetworkAdapterConfiguration
filter: IPEnabled=True
properties: ["Description", "IPAddress", "DefaultIPGateway", "DNSServerSearchOrder"]
Security audit: startup entries
class: Win32_StartupCommand
Security Constraints (SD-039)
- Query-only — method invocations structurally impossible
- Local machine only — ComputerName not exposed
- Deny-by-default — only classes in
allowed_classes (grille.toml) work
- Hardcoded blocks (cannot be overridden):
Win32_Product (MSI reconfiguration disaster), Win32_Process, Win32_Service, StdRegProv, all WMI event subscription and persistence classes
grille.toml Config
# Add "wmi" to modules list
modules = ["...", "wmi"]
[roles.developer.wmi]
allowed_classes = [
"Win32_OperatingSystem",
"Win32_ComputerSystem",
"Win32_Processor",
"Win32_PhysicalMemory",
"Win32_DiskDrive",
"Win32_LogicalDisk",
"Win32_NetworkAdapterConfiguration",
"Win32_BIOS",
"Win32_StartupCommand",
"Win32_BaseBoard",
"Win32_SystemEnclosure",
]
Output Format
- 1 instance: key-value pairs aligned by property name width
- Multiple instances: column table, max 500 rows, columns truncated to 60 chars
- Empty/null properties are omitted from output
Notes
- Uses native COM/IWbemServices — no PowerShell, no WMIC subprocess
- Typical query latency: 20-80ms
Win32_PhysicalMemory often returns multiple rows (one per DIMM slot)Win32_NetworkAdapterConfiguration with IPEnabled=True filter avoids returning dozens of virtual adapters
1---2name: grille-wmi3description: SKILL.md — grille-wmi4---5# SKILL.md — grille-wmi67## What This Skill Does8Query WMI/CIM classes on the local Windows machine for hardware, OS, BIOS, network, and system inventory data. Returns structured results as key-value pairs (single instance) or tables (multiple instances).910## Tool11`wmi_query` — query any WMI class listed in `allowed_classes` (grille.toml).1213## Parameters14| Parameter | Required | Description |15|---|---|---|16| `class` | Yes | WMI class name, e.g. `Win32_Processor` |17| `filter` | No | WQL WHERE clause (without `WHERE`), e.g. `DriveType=3` |18| `properties` | No | Array of property names to return (omit = all) |1920## Safe Class Set (initial allowlist)21| Class | What It Returns |22|---|---|23| `Win32_OperatingSystem` | OS version, build, uptime, memory stats |24| `Win32_ComputerSystem` | Hostname, domain membership, manufacturer, model, RAM |25| `Win32_Processor` | CPU name, cores, speed, socket, architecture |26| `Win32_PhysicalMemory` | RAM slot layout, capacity per DIMM, speed, manufacturer |27| `Win32_DiskDrive` | Physical disk model, size, interface, firmware |28| `Win32_LogicalDisk` | Drive letters, filesystem, free/total space |29| `Win32_NetworkAdapterConfiguration` | IP address, subnet, gateway, DNS, DHCP |30| `Win32_BIOS` | BIOS version, release date, serial number |31| `Win32_StartupCommand` | Startup entries (useful for security audits) |32| `Win32_BaseBoard` | Motherboard manufacturer, model, serial number |33| `Win32_SystemEnclosure` | Chassis type (desktop/laptop/server), serial number |3435## Common Patterns3637### Hardware inventory38```39class: Win32_Processor40properties: ["Name", "NumberOfCores", "NumberOfLogicalProcessors", "MaxClockSpeed"]41```4243### RAM layout44```45class: Win32_PhysicalMemory46properties: ["BankLabel", "Capacity", "Speed", "Manufacturer"]47```4849### Fixed drives only50```51class: Win32_LogicalDisk52filter: DriveType=353properties: ["DeviceID", "Size", "FreeSpace", "FileSystem", "VolumeName"]54```5556### Active network adapters57```58class: Win32_NetworkAdapterConfiguration59filter: IPEnabled=True60properties: ["Description", "IPAddress", "DefaultIPGateway", "DNSServerSearchOrder"]61```6263### Security audit: startup entries64```65class: Win32_StartupCommand66```6768## Security Constraints (SD-039)69- **Query-only** — method invocations structurally impossible70- **Local machine only** — ComputerName not exposed71- **Deny-by-default** — only classes in `allowed_classes` (grille.toml) work72- **Hardcoded blocks** (cannot be overridden): `Win32_Product` (MSI reconfiguration disaster), `Win32_Process`, `Win32_Service`, `StdRegProv`, all WMI event subscription and persistence classes7374## grille.toml Config75```toml76# Add "wmi" to modules list77modules = ["...", "wmi"]7879[roles.developer.wmi]80allowed_classes = [81 "Win32_OperatingSystem",82 "Win32_ComputerSystem",83 "Win32_Processor",84 "Win32_PhysicalMemory",85 "Win32_DiskDrive",86 "Win32_LogicalDisk",87 "Win32_NetworkAdapterConfiguration",88 "Win32_BIOS",89 "Win32_StartupCommand",90 "Win32_BaseBoard",91 "Win32_SystemEnclosure",92]93```9495## Output Format96- **1 instance**: key-value pairs aligned by property name width97- **Multiple instances**: column table, max 500 rows, columns truncated to 60 chars98- Empty/null properties are omitted from output99100## Notes101- Uses native COM/IWbemServices — no PowerShell, no WMIC subprocess102- Typical query latency: 20-80ms103- `Win32_PhysicalMemory` often returns multiple rows (one per DIMM slot)104- `Win32_NetworkAdapterConfiguration` with `IPEnabled=True` filter avoids returning dozens of virtual adapters
getgrille