听懂了 - 文章转AI播客

• Outcome: Review
• Latest audit: Aug 20, 2026 · 3:10 PM UTC
• Version: 1.1.0

Overview

The skill appears to perform article-to-podcast conversion, but it sends user content through an unencrypted remote service and includes scraping-bypass guidance that users should review carefully.

Install only if you are comfortable sending article links or text to the listed remote server over unencrypted HTTP. Do not use it for private, paid, confidential, or sensitive content, and review whether automated fetching of a source is allowed before converting it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill declares no permissions while clearly instructing network access to an external backend and implying environment/local execution for test scripts. Missing or inaccurate permission declarations weaken review and consent controls, making it easier for a seemingly simple content-conversion skill to perform external communication without transparent authorization. In this context, the risk is heightened because article URLs and related user request data are sent to a third-party service.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill examples send article URLs and a user_id to a backend over plain HTTP, not HTTPS. Because the connection is unencrypted, network attackers can intercept or modify requests and responses, exposing reading activity, identifiers, generated audio links, and even tampering with task status or returned content. The skill context makes this more dangerous because it routinely handles user-supplied links and asynchronously returns remote media URLs.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation explicitly specifies HTTP for the API base URL and notes HTTPS is only planned later, but it does not warn that article content, user identifiers, and task metadata will be transmitted in cleartext. This exposes potentially sensitive submitted URLs/text and user_id values to interception or modification by any network observer or man-in-the-middle, which is especially risky for a skill that processes arbitrary article content on behalf of users.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The audio access section documents generated MP3 files as retrievable over plain HTTP without warning users that the audio can be intercepted or tampered with in transit. Because the service converts user-submitted article content into audio, the resulting files may contain private or copyrighted material, and insecure delivery increases the risk of eavesdropping, content replacement, or malicious media substitution.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document explicitly recommends using Playwright to simulate a real browser and bypass WeChat anti-scraping protections, but does not pair that guidance with strong compliance controls, authorization requirements, or user-facing warnings. In a content-conversion skill that fetches third-party articles on demand, this normalizes evasion of publisher access controls and can facilitate unauthorized collection of protected content, creating legal, policy, and platform-abuse risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script takes user-supplied article URLs or text and sends them to an external backend service, but it provides no explicit disclosure or consent prompt that user content will leave the local environment. In a skill that may process arbitrary articles or pasted text, this creates a real privacy and data-handling risk, especially if users assume the conversion is local or are unaware of the remote host involved.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The backend base URL uses plain HTTP, so submitted article text, URLs, and task metadata are sent without transport encryption. This exposes user data to interception or tampering by network attackers and also permits manipulated responses from the backend, which is especially concerning because the skill is explicitly designed to send user-provided content off-host.

Static analysis

No suspicious patterns detected.