视频号投放背调

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 7:08 AM UTC
• Version: 1.4.2

Overview

This is a disclosed WeChat Channel audit skill that uses a third-party API and local report files, with no evidence of hidden, destructive, or deceptive behavior.

Use this skill only if you are comfortable sending WeChat Channel account/video identifiers to api.we-media.cn and using a local WM_API_KEY for billable API calls. Keep the key in environment/config storage rather than chat, review estimated costs before using --yes, and choose output/checkpoint paths deliberately because reports are saved locally.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description describes a full creator-analysis workflow focused on discovering a video account, retrieving recent works, collecting interaction data, and producing an assessment report. The actual code chunk does not implement any of those behaviors. Instead, it provides a utility function that filters sensitive keys, redacts temporary/signed URLs, and normalizes some values for safer evidence handling. This is a materially different primary purpose from the declared skill behavior, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的是一个完整的投放前尽调/评估技能，核心能力应包括账号发现、作品列表获取、逐作品采集、跨作品汇总分析和投资建议输出。给出的代码块仅是一个数据处理模块，专注于视频号互动指标的语义标准化：处理 likeCount/favoriteCount/recommendCount 的映射，保留精确计数，构造 metricDetails，计算互动总量、占比和相对点赞比，并明确避免推断收藏意图、传播原因或转化结论。虽然这可作为“逐条取作品互动数据”中的一个底层辅助组件，但它远不足以支撑声明中的主要用途，且其实际主功能与声明的完整尽调能力存在明显范围差异，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a business workflow for evaluating a 视频号 creator/account based on recent content and interaction data. The supplied code does something materially different: it is infrastructure for API request identity, envelope error parsing, product catalog retrieval, billing/price calculation, and snapshot diffing. There is no logic for 搜号定位, 拉作品列表, 获取作品资料/互动数据, or 汇总“值不值得投”的报告. Because the primary purpose and actual capabilities are unrelated to the declared end-user function, this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

该代码块不是一个实现“搜号定位→拉作品→取互动数据→生成投放评估报告”的业务技能主体，而是所有微信生态 skill 共用的基础设施层。它提供的是通用网络请求、鉴权、价格估算、缓存、分页和格式化输出等支撑能力。虽然其中提到若干 wechat-native-channel 相关 product_slug，说明可被视频号类技能复用，但当前代码并未体现账号搜索、作品逐条分析、互动稳定性统计、代表作识别、更新频率计算或“值不值得投”的评估结论等核心业务行为。因此，声明与该代码块实际行为存在明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description promises a domain-specific auditing flow for evaluating a video account's worthiness for promotion, including account lookup, fetching recent works, collecting interaction data, and summarizing an assessment report. The provided code does not perform those tasks. Instead, it contains low-level helper functions for persistence, locking, hashing, reading/writing JSON, and pagination mechanics. While such helpers could support a larger due-diligence workflow, this chunk by itself does not demonstrate the declared primary behavior and exposes additional undeclared operational capabilities around local file handling and concurrency control. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill instructs use of environment variables, local file I/O, and outbound network access, but it does not declare any explicit tool scope or permissions boundaries. In an agent environment, this can lead to over-broad execution authority and makes it harder to constrain or audit what the skill is allowed to access or transmit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill description and operational instructions are entirely written in Chinese and present the workflow as the required default, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The skill directs outbound communication to an external API and includes guidance to use an API key, estimate pricing, and retrieve data from a third-party domain. Any skill that transmits user-supplied queries, account identifiers, or derived results off-platform creates data exposure and supply-chain trust risks, especially when no explicit domain allowlist or data-minimization guardrail is declared in permissions.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This finding reflects continued reliance on an external service for documentation, product browsing, and likely operational decisions. Even when the domain appears legitimate, sending workflow context or identifiers to third-party infrastructure can leak business-sensitive research targets and usage patterns if the skill is not tightly scoped.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。
创建专属 Skill 不代表免除 API 调用费用，也不保证结果、收益或留存率。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The public products endpoint is an external transmission surface; querying it is not inherently malicious, but it still establishes outbound connectivity and potential metadata leakage. In agent settings, unscoped external requests can be abused or can unexpectedly expose usage timing, IP, and workflow intent.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。
创建专属 Skill 不代表免除 API 调用费用，也不保证结果、收益或留存率。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

This line explicitly instructs using the configured API key against a third-party products endpoint, which means authenticated external transmission occurs. Although the document warns not to expose the key, the act of sending authenticated requests off-platform still carries credential misuse and data-disclosure risk if the environment, headers, or endpoint controls are weak.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。
创建专属 Skill 不代表免除 API 调用费用，也不保证结果、收益或留存率。

## 请求身份与安全

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file hard-codes Chinese labels and explanatory notes in user-facing strings such as metric names and analysis notes, indicating the skill's outputs are fixed to Chinese. Under the stated policy, forcing a specific language without user opt-in or a documented justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The exception message at L109 is presented only in Chinese, which forces a specific language for users encountering this error. The file does not offer localization, user language selection, or a documented justification that this skill is intentionally region- or locale-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The top-level docstring and all user-facing guidance in this file are written exclusively in Chinese, indicating the skill is designed around a single language/locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless a justified regional constraint is documented, which is not present here.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/wm_core.py (reported line 33)May include surrounding context.

python

from workflow_core import atomic_json, digest, next_params, APIError, workspace_lock
from platform_contract import identity_headers, catalog, price_micros, failure, product_path

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes a narrowly scoped workflow for evaluating WeChat Channel creators and their recent content, but this module dynamically loads a full endpoints catalog and exposes a generic caller for any endpoint key in that catalog. That creates a reusable capability surface not justified by the stated purpose of a single-purpose ad-audit skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says this skill evaluates WeChat video-channel creators by locating accounts, fetching recent works, collecting per-work interaction metrics, and producing an investment-worthiness report. In contrast, this file’s module docstring and constants describe a generic 'portable gateway' for live prices, durable requests, locking, JSON persistence, and API plumbing, with no code here tied to creator-audit/reporting semantics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The exception messages at L076 and L082 are hard-coded in Chinese, which imposes a specific language on users. The file does not indicate that this skill is region-specific or that users can opt into this locale, so this appears to violate the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The command-line interface supports listing all available endpoints and estimating arbitrary calls, which is broader than the manifest's described behavior of producing a creator-investment evaluation report. While useful for development, these capabilities are not justified by the end-user purpose stated in the manifest.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The docstring states the module provides 'live prices, durable requests and evidence exports,' but the visible implementation contains hashing, JSON file I/O, locking, pagination, and API error handling only. That is an active mismatch between the file’s top-level documentation and what the code in this file actually implements.

Content

No source excerpt is available for this finding.