视频号博主动态

• Outcome: Review
• Latest audit: Sep 4, 2026 · 9:28 AM UTC
• Version: 1.0.1

Overview

The skill mostly supports the advertised WeChat video-account lookups, but it also contains under-disclosed local-file upload paths and ships Python bytecode, so it belongs in Review before install.

Install only if you trust the publisher and the api.we-media.cn service with your API key and queried data. Before use, remove the shipped __pycache__ files, use a dedicated low-privilege API key, and do not allow the agent to pass --file or local videoUrl/audioUrl paths unless you intentionally want a local file uploaded to remote temporary storage. Review config.json, generated output files, and the local cache for sensitive content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose is narrowly framed as listing a creator's feed, but the skill actually includes broader behaviors such as generic remote API invocation, credential onboarding, billing flows, caching, exports, and even local file upload to remote temporary storage. This mismatch can mislead users and reviewers about the true trust boundary, causing sensitive data exposure or unintended paid/networked actions under the guise of a simple lookup skill.

Ae1

High

• Category: analysis-evasion

Content

> 曼格云 skill ｜ 环节：追号 ｜ 底层统一底座 `wm_core.py`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Skill ships a __pycache__ directory that normal discovery skips

High

• Category: Supply Chain

Content

Python may load .pyc from this directory even when decoy .py sources look clean (PEP 552 UNCHECKED_HASH).

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is declared as listing a 视频号博主's works, but the endpoint inventory exposes a much broader API surface including file upload,公众号 scraping/search, download URLs, and AI media processing. This violates least privilege and creates a capability mismatch where an agent using the skill could be induced to perform actions far outside the user-visible purpose.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill bundles extensive 公众号 article/profile/search capabilities that are unrelated to 视频号博主动态 tracking. This unnecessary cross-domain access greatly enlarges the attack surface and allows an agent to collect unrelated content sources despite the narrow declared purpose.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Video understanding and audio transcription endpoints add powerful content extraction capabilities unrelated to simply listing 视频号作品. If exposed through this skill, an attacker could pivot from harmless-looking account lookups into analysis of arbitrary media, expanding both data-processing scope and exfiltration potential.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill requires environment access, local file read/write, and network access, but it does not declare any tool scope or permissions boundary. That makes the effective capability set implicit and harder to review, increasing the risk of over-privileged execution, especially since it writes API keys to config files and performs remote calls.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file instructs the agent to relay a fixed Chinese message verbatim to the user, with no option to adapt to the user's preferred language or locale. This is a natural-language policy issue because it imposes a specific language rather than offering a choice or documenting a justified locale constraint.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This manifest is written entirely in Chinese, including the compliance rationale in metadata, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking or China-specific audience. The policy allows locale constraints only when explicitly documented and justified; that justification is not present as a locale constraint here.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The temporary file upload ticket endpoint allows moving local files to external temporary storage, which is unrelated to listing a creator's recent works. In an agent setting, this materially raises exfiltration risk because prompt injection or misuse could cause sensitive local content to be uploaded under the cover of an unrelated skill.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: Natural-language fields such as "name", "purpose", and "note" are consistently Chinese-only across the endpoint catalog. Because the file provides no opt-in, alternative locale, or explicit region-scoped justification, it appears to impose a single language on all users.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The download/playback URL endpoint enables retrieval of direct video access information, which exceeds the documented scope of listing works and generating share links. This broadens the skill from metadata discovery into media access, increasing the chance of unauthorized redistribution or downstream processing.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script will automatically upload a local file to a remote platform when --file is provided, and it will also treat videoUrl/audioUrl values that happen to be local filesystem paths as files to upload. This creates a real data exfiltration risk because a user may not realize a local path will be transmitted off-host, especially in a skill whose primary purpose is fetching a creator feed rather than handling local files.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)

• Confidence: 96% confidence
• Finding: The code implicitly interprets any non-URL string in videoUrl/audioUrl that matches a local file path as a file to upload, which can cause accidental exfiltration without the user's awareness. This hidden behavior is more dangerous than the explicit --file path because ordinary parameter input can unexpectedly trigger a remote upload.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)

• Confidence: 96% confidence
• Finding: The code implicitly interprets any non-URL string in videoUrl/audioUrl that matches a local file path as a file to upload, which can cause accidental exfiltration without the user's awareness. This hidden behavior is more dangerous than the explicit --file path because ordinary parameter input can unexpectedly trigger a remote upload.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)

• Confidence: 96% confidence
• Finding: The code implicitly interprets any non-URL string in videoUrl/audioUrl that matches a local file path as a file to upload, which can cause accidental exfiltration without the user's awareness. This hidden behavior is more dangerous than the explicit --file path because ordinary parameter input can unexpectedly trigger a remote upload.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

import urllib.parse
import hashlib

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The manifest describes a read-oriented skill that lists a creator's published works by account ID or share link. This file implements a generic `upload_file()` capability that reads arbitrary local files, obtains upload tickets, and uploads content to remote storage for later AI use, which is not justified by the stated purpose of enumerating a blogger's posts.

Static analysis

No suspicious patterns detected.