微信公众号监控

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:36 PM UTC
• Version:
  1.0.0

Overview

This skill matches its stated WeChat public-account monitoring purpose, but users should handle the mptext API key carefully and confirm any scheduled push setup.

Install only if you trust the mptext.top service and are comfortable monitoring the selected public accounts on a recurring schedule. Configure MPTEXT_API_KEY as an environment variable, do not put the key in source files or shared workspace notes, confirm where scheduled reports are delivered, and use simple product folder names.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README advertises automatic daily monitoring and push delivery but does not explain what data is transmitted, where reports are sent, or the privacy implications of continuously collecting and forwarding content. In a skill that monitors third-party WeChat public accounts and pushes reports on a schedule, this omission can lead users to enable recurring data collection or outbound transmission without informed consent or proper review.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The README explicitly tells users they can hardcode an API key directly into monitor.py, which encourages unsafe secret handling and increases the chance the credential will be leaked through source control, backups, logs, or screen sharing. Because this is an installation guide, users are likely to follow it verbatim, making the insecure practice materially more dangerous in context.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly instructs users to hardcode an API key into the script, which creates a high risk of credential leakage through source control, logs, screenshots, backups, or accidental sharing. Once exposed, the key could be reused to access the third-party service and potentially consume quota or retrieve monitored data.

VirusTotal

66/66 vendors flagged this skill as clean.