Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed API-backed video analysis helper that uses a third-party service and optional media upload, with confirmation steps before paid or local-file operations.
Install only if you are comfortable using the Mangyun/we-media.cn API service. Configure the API key locally, review the live price estimate before confirming, and do not upload private or regulated videos unless you are comfortable sending that selected file to the provider's temporary storage and analysis service.
声明描述的是一个面向视频内容理解的多模态分析技能，而提供的代码片段只是一个数据安全辅助模块。它递归移除敏感键（如cookie、authorization、access_token等），并对微信文章链接、微信视频预览链接及带签名参数的资源URL做脱敏或占位替换。这与视频分析、OCR、时间线生成、费用分档确认等核心功能无直接对应关系。根据评估标准，这不是单纯的支持性细节，因为当前代码片段的行为与声明的主要目的 materially different，且没有体现声明中的核心能力，因此应判定为不匹配。
声明聚焦于“看懂视频内容”的多模态分析，而代码仅处理视频号接口中的互动数据字段语义：如 likeCount/favoriteCount/recommendCount 的映射、精确值校验、展示文案、互动结构占比和比值计算。这属于社交互动指标规范化/分析工具，不涉及视频帧、音频、OCR、时间线、镜头语言或情绪建模。两者主目的和能力范围明显不一致，因此应判定为描述与行为不匹配。
声明描述的核心能力是‘分析视频内容’，属于多模态推理/OCR/镜头与情绪分析场景；而实际代码是一个与平台API请求、商品目录、价格估算和数据快照相关的基础工具模块。两者主功能完全不同。虽然声明中提到‘执行前先确认费用’，代码里确实有价格估算能力，但这只是声明技能的一个配套环节，远不足以支持所宣称的视频分析主能力。代码还包含未声明的快照比对、目录抓取、请求身份与响应校验等能力，因此描述与行为存在明显不匹配。
该代码块与声明用途存在明显不匹配。声明描述的是一个面向最终用户的视频多模态分析技能，而实际代码只是通用基础设施层，用于多个技能共用的API访问、鉴权、计费预估、上传文件和格式化输出。虽然其中的 upload_file() 说明可把视频文件上传后供AI接口使用，estimate() 也支持按 analysisMode 计价，这些都只是支撑视频分析技能的基础能力；代码本身没有任何特定于视频理解的端点调用、提示构造、结果解析或业务流程。因此，这段代码不能单独支撑声明中的核心能力，属于描述与实际行为的实质性不一致。
声明的核心能力是“分析视频内容”，而代码实际展示的是底层工作流工具代码，不是视频分析实现。代码中没有看到视频输入处理、帧提取、模型调用、OCR、镜头/情绪分析、摘要生成、时间线生成或‘三档深度/费用确认’相关逻辑。相反，它主要负责持久化、锁、错误封装和分页续取等通用基础设施，并且指向外部 API 网关。即使这些可能是某个更大系统的配套组件，就该代码片段本身而言，其行为与声明用途存在明显不一致。
Without declared permissions the skill's intent is opaque and cannot be validated.
The manifest description and usage scenario broadly describe analyzing video content whenever a user wants AI to understand a video, but they do not define explicit trigger phrases, exclusions, or activation boundaries. In markdown/manifest scope, this can cause overly broad matching against many common requests about videos or OCR.
The skill name, description, summary, and all operational instructions are written exclusively in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This is a natural-language locale constraint that can violate language-choice policy when not made explicit or optional.
The skill explicitly directs users to transmit data to an external third-party service and later states that local audio/video can be uploaded off-device to temporary object storage. Even with consent language, this is a real data-transfer risk because video files, OCR text, and derived analysis may contain sensitive or regulated content, and the trust boundary leaves the local environment.
先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。
文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。
This line continues the external-service integration and documentation path for the same third-party platform. The danger is contextual: a video-analysis skill inherently handles potentially sensitive media, so sending content or metadata to external domains can expose private information if users are not fully informed or if the service is compromised.
文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。
创建专属 Skill 不代表免除 API 调用费用，也不保证结果、收益或留存率。
The public/products API endpoint indicates outbound communication to an external service. While normal for API-backed skills, it is still a true security-relevant finding because it expands the attack surface and may disclose usage patterns, account metadata, or query context to a third party.
文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。
创建专属 Skill 不代表免除 API 调用费用，也不保证结果、收益或留存率。
The authenticated products/pricing request is particularly sensitive because it uses the user's API key and may reveal account-linked product access, pricing, and activity to the external provider. In the context of a skill that may also upload local media, this creates a meaningful trust and privacy boundary that users must understand before execution.
文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。
创建专属 Skill 不代表免除 API 调用费用，也不保证结果、收益或留存率。
## 请求身份与安全
The manifest sets the skill display name entirely in Chinese ("视频内容理解官") with no accompanying indication that language selection is optional or that the skill is intended only for a Chinese-language context. This can violate language/locale policy when users are not given a choice or clear justification for the locale restriction.
User-facing natural-language values such as endpoint names and purposes are written only in Chinese, with no indication that users can opt into another language or locale. This can violate language/locale policy expectations when a skill is used in broader multilingual contexts.
The snapshot function creates directories and atomically writes a JSON file to the provided path, replacing any existing file. Although the docstring describes the behavior technically, there is no user-facing prompt, log, or warning at the point of write to disclose that local files will be created or overwritten.
The manifest describes a skill for analyzing video content, generating summaries, timelines, OCR, shot/motion/transition, and emotion analysis. However, the code advertises an additional endpoint ch-download-url, which is a download/link retrieval capability rather than an analysis function, and that capability is not justified by the stated purpose.
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
# Only an explicit --file can upload a user-selected media file.
if file_path:
params["videoUrl" if "videoUrl" in ep.get("params", []) else "audioUrl"] = wm.upload_file(file_path)
if pages > 1 or checkpoint_path:
rows = wm.paginate(key, max_pages=pages, checkpoint=checkpoint_path, **params)
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
from workflow_core import atomic_json, digest, next_params, APIError, workspace_lock
from platform_contract import identity_headers, catalog, price_micros, failure, product_path
EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124
OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"
The upload_file() function reads arbitrary local files and uploads their full contents to external object storage, then returns a public HTTPS URL, but it does not itself enforce any explicit user confirmation, warning, or visibility at the point of exfiltration. In a skill that processes local media for remote AI analysis, this creates a real privacy and data-handling risk if higher-level callers invoke upload_file() on sensitive files without clearly obtaining user consent.
The raised ValueError messages are hard-coded in Chinese (此工作区已有任务运行，请等待完成) with no indication of locale selection or user opt-in. This is a natural-language policy issue because the skill imposes a specific language for user-facing output instead of offering a language choice or documenting a justified locale restriction.
The code returns user-visible placeholder strings in Chinese only (e.g. temporary video/resource link notices) without any indication of language selection or locale opt-in. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
This JSON defines available endpoints and their purposes, but it does not document any explicit constraints or negative examples for when each endpoint should be selected or invoked. In a manifest-style file, that lack of specificity can lead to overly broad or unintended activation/selection by downstream tooling.
The raised ValueError message is written only in Chinese, which imposes a specific language on users without opt-in or explanation. This is a natural-language locale policy issue because the file otherwise uses English and does not document a Chinese-only audience or region-specific constraint.
This code file contains natural-language instructions and output text entirely in Chinese, including the main docstring and subsequent CLI guidance, with no indication that users can opt into another language. That creates a locale-policy concern because the skill effectively enforces a specific language in its interface.
This file's primary descriptive text and user guidance are presented in Chinese only, including operational explanations and usage-related messaging. That can amount to forcing a specific language/locale without offering user choice, which matches the language-policy concern for natural-language content.