音视频转写台

• Outcome: Review
• Latest audit: Sep 4, 2026 · 9:33 AM UTC
• Version: 1.0.1

Overview

This skill mainly does paid media transcription through a remote API, but it ships broader API machinery and local-file upload behavior that are not clearly disclosed for a narrow transcription skill.

Review before installing. Use this only if you are comfortable giving the skill a We-Media API key, sending media or local files to api.we-media.cn for processing, paying per confirmed request, and having successful results cached locally. The publisher should remove unrelated endpoints and bytecode, and make local-upload behavior explicit.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill advertises a simple public-URL transcription function, but the documentation describes a broader remote API wrapper with billing, balance reporting, caching, pagination, multiple export formats, and possible local file upload. This kind of overbroad hidden functionality weakens transparency and can cause users to expose more data, incur costs, or grant more trust than intended.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill advertises a simple public-URL transcription function, but the documentation describes a broader remote API wrapper with billing, balance reporting, caching, pagination, multiple export formats, and possible local file upload. This kind of overbroad hidden functionality weakens transparency and can cause users to expose more data, incur costs, or grant more trust than intended.

Ae1

High

• Category: analysis-evasion

Content

> 曼格云 skill ｜ 环节：做内容 ｜ 底层统一底座 `wm_core.py`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Skill ships a __pycache__ directory that normal discovery skips

High

• Category: Supply Chain

Content

Python may load .pyc from this directory even when decoy .py sources look clean (PEP 552 UNCHECKED_HASH).

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is presented as a narrow audio/video transcription capability, but the endpoint catalog exposes a much broader API surface including hot-search aggregation, WeChat article/account scraping, video account analytics, and video understanding. This is dangerous because it creates hidden capability expansion: an agent or downstream tool can invoke unrelated data-collection and surveillance functions that users did not consent to when enabling a transcription skill.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The configuration includes social-media discovery and intelligence endpoints unrelated to transcription, such as account/article search, metrics, snapshot/reporting, and channel analytics. In the context of a transcription skill, these hidden collection features materially increase misuse risk by enabling large-scale profiling, content harvesting, and off-scope data access under a misleading wrapper.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no explicit tool scope or permission boundaries, yet its documented behavior clearly relies on network access, reading environment-like secrets (API key), and writing local files. This creates an authorization gap: an execution environment may grant broader capabilities than users expect, increasing the risk of unintended data access, secret handling, or outbound requests.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The file’s user-facing instructions, prompts, and required quoted text are all in Chinese, and there is no indication that users may choose another language. This can violate a language/locale policy when a skill implicitly forces one language without explicit user opt-in or documented regional justification.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module docstring and usage text are written entirely in Chinese, which imposes a specific language on users. The policy allows locale constraints only when clearly justified or when the user is given a choice, neither of which is present here.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)

• Confidence: 93% confidence
• Finding: The script auto-detects when a parameter value is a local filesystem path and silently uploads that file to remote storage. This is more dangerous than the explicit --file flow because a user may intend to pass an identifier or path for local handling, yet the program transparently exfiltrates the file without a dedicated confirmation step tied to that upload behavior.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)

• Confidence: 93% confidence
• Finding: The script auto-detects when a parameter value is a local filesystem path and silently uploads that file to remote storage. This is more dangerous than the explicit --file flow because a user may intend to pass an identifier or path for local handling, yet the program transparently exfiltrates the file without a dedicated confirmation step tied to that upload behavior.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)

• Confidence: 93% confidence
• Finding: The script auto-detects when a parameter value is a local filesystem path and silently uploads that file to remote storage. This is more dangerous than the explicit --file flow because a user may intend to pass an identifier or path for local handling, yet the program transparently exfiltrates the file without a dedicated confirmation step tied to that upload behavior.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: This manifest-style JSON uses Chinese natural-language fields throughout, including endpoint names, purposes, and notes, but provides no indication that the skill is region-specific or that users can opt into this locale. Under the policy, forcing a specific language without user choice or documented justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: This file contains natural-language instructions, help text, and operational guidance exclusively in Chinese, including the module docstring and later CLI/help strings. Under the language/locale policy, forcing a specific language without opt-in is a policy concern unless the tool is clearly documented as region-specific, which is not established in this file.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

import urllib.parse
import hashlib

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Static analysis

No suspicious patterns detected.