视频号投放背调

• Outcome: Review
• Latest audit: Sep 4, 2026 · 9:30 AM UTC
• Version: 1.0.1

Overview

This skill mostly matches a WeChat Channel advertising audit workflow, but it also contains an under-disclosed local-file upload capability and bundled bytecode that users should review before installing.

Install only if you are comfortable giving the skill a ManGeYun/We-Media API key, letting it write config/cache/report files locally, and making paid API calls after confirmation. Do not pass local file paths or --file to this skill unless the upload behavior has been removed or explicitly approved, because the current source can send local files to external temporary storage even though that is not part of the advertised audit workflow.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is a narrow video-channel audit flow, but the described behavior indicates a broader generic API framework with extra capabilities such as arbitrary endpoint invocation, local file upload to remote temporary storage, generalized billing/estimation, caching, and multi-format export. This mismatch is dangerous because users and agents may trust the skill for a limited due-diligence task while it actually enables wider data egress and remote interactions that were not transparently disclosed.

Ae1

High

• Category: analysis-evasion

Content

> 曼格云 skill ｜ 环节：找号 ｜ 底层统一底座 `wm_core.py`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Skill ships a __pycache__ directory that normal discovery skips

High

• Category: Supply Chain

Content

Python may load .pyc from this directory even when decoy .py sources look clean (PEP 552 UNCHECKED_HASH).

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no explicit tool scope or permission boundaries even though its documented behavior requires environment access, local file read/write, and network access. That creates an over-privileged, opaque execution model where an agent may exercise sensitive capabilities without user-visible constraints, increasing the risk of unintended data access, secret handling, or outbound transmission.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: This manifest/config file includes natural-language policy-relevant text that assumes a specific language locale, such as the Chinese-only excluded_reason field. Because the file does not offer any language or locale choice, it may violate a policy requiring user opt-in before forcing a specific language.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The temporary file upload ticket enables sending local files to a third-party cloud storage and returning a public URL, which is not justified by a creator due-diligence workflow based on account/video metadata. In an agent context, this materially raises exfiltration risk because local or user-provided files could be uploaded off-platform under a benign-sounding capability.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The endpoint catalog uses Chinese for user-facing natural-language fields like name and purpose throughout the file, which effectively fixes the skill's interface to one language. Under the stated policy, this should be justified as region-specific or accompanied by user choice.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
      "free": true,
      "internal": true,
      "note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
    },
    {
      "key": "account-balance",

• Confidence: 96% confidence
• Finding: The upload helper note explicitly describes a workflow for transferring local files to temporary cloud storage and producing a public URL consumable by downstream AI APIs. In an agent skill, this is a classic exfiltration-enabling primitive: if the agent can access sensitive local/user files, it can move them to external storage outside the original trust boundary.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
      "free": true,
      "internal": true,
      "note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
    },
    {
      "key": "account-balance",

• Confidence: 96% confidence
• Finding: The upload helper note explicitly describes a workflow for transferring local files to temporary cloud storage and producing a public URL consumable by downstream AI APIs. In an agent skill, this is a classic exfiltration-enabling primitive: if the agent can access sensitive local/user files, it can move them to external storage outside the original trust boundary.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
      "free": true,
      "internal": true,
      "note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
    },
    {
      "key": "account-balance",

• Confidence: 96% confidence
• Finding: The upload helper note explicitly describes a workflow for transferring local files to temporary cloud storage and producing a public URL consumable by downstream AI APIs. In an agent skill, this is a classic exfiltration-enabling primitive: if the agent can access sensitive local/user files, it can move them to external storage outside the original trust boundary.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The endpoint catalog exposes many capabilities unrelated to the stated 视频号投放背调 workflow, including公众号/article lookup,小程序 search, hot-search, low-baseline viral content, account balance, file upload, and AI analysis. This over-broad capability surface violates least privilege and increases the chance the skill can be repurposed for unrelated data access or cost-incurring actions beyond the user's expected task.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: A video download/playback URL endpoint exceeds the minimum data needed to assess whether a 视频号 account is worth advertising on; metadata and metrics are usually sufficient. Providing retrievable playback URLs broadens the skill from analytics into media access, enabling unnecessary content extraction or redistribution workflows.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The video-understanding and audio-transcription endpoints allow broad AI analysis of arbitrary media, going beyond the declared workflow of searching accounts, listing recent works, and summarizing engagement stability. In practice, these endpoints can process uploaded or remote media content unrelated to the stated task, increasing privacy, scope-creep, and billing-abuse risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script uploads local files to external infrastructure and sends collected parameters to remote endpoints, but the only user-facing gate is a pricing confirmation via --yes. There is no explicit disclosure of what data will leave the machine, where it will be stored, or a separate consent flow for file transmission, which creates a real data exfiltration/privacy risk if a user supplies sensitive local paths or identifiers.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This Python file contains its primary documentation and many user-facing messages exclusively in Chinese, which imposes a specific language on users without any opt-in or alternative locale handling. The policy explicitly flags language/locale constraints when the skill forces a language without user choice.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

import urllib.parse
import hashlib

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The manifest describes a read-oriented workflow for evaluating a video account by locating the account, fetching recent works, and summarizing interaction metrics into a report. This core file additionally provides upload_file(), which uploads arbitrary local files to remote temporary storage and returns public HTTPS URLs for downstream AI APIs; that capability is not justified by the stated purpose of this skill.

Static analysis

No suspicious patterns detected.