视频号评论洞察

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 5:44 AM UTC
• Version: 1.0.0

Overview

The skill is a bounded WeChat Channel public-comment collection and reporting workflow that discloses its API-key, network, budget, and local-output behavior, with one dormant under-documented extra workflow noted.

Install only if you are comfortable running local Python scripts that use your We-Media/Mangyun API key to make paid requests to api.we-media.cn and write reports into a workspace. Review the estimate and budget before approving collection, and be aware the package also contains an inactive official-account competitor-analysis workflow not described in the main skill text.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

描述与代码在“视频号评论调研”部分大体一致：代码验证 comments 计划，支持 keyword 搜索视频号账号、按账号列作品、按视频 URL/objectId 解析作品、采集公开评论及 replies、设置数量页数上限、预算估算与执行预算、生成 evidence/analysis-input/Excel 输出，也体现了中断恢复/重渲染思路。因此若只看 comments 路径，匹配度较高。 但从整个提供的代码块来看，它不仅做评论采集，还包含 collect_competitors、HISTORY/METRICS/CONTENT 等公众号能力，能按公众号账号/文章 URL 抓取历史文章、阅读点赞分享等指标、正文文本，并输出‘公众号同行对标’报告。这属于额外且实质性的未声明能力，不是单纯实现细节。虽然 main 当前调用 main("comments")，降低了该能力在此入口下的可达性，但代码块本身明确实现了与声明不同的第二主用途。因此应判定为存在描述—行为不匹配，主要原因是代码具备未声明的公众号竞品/文章分析能力。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

代码的核心职责与声明用途明显不同。该文件围绕 API 产品目录、价格计算、请求身份头、响应封装错误解析和快照比对展开，属于底层计费/协议辅助模块。虽然其中的 price_micros、estimate_plan、snapshot 等能力可能可作为“预算上限”或“续采”相关的支撑组件，但它没有任何实际抓取视频号内容或评论的逻辑，也没有分析评论文本、生成洞察或输出 Excel 的实现。因此，就此代码块而言，声明描述不能准确代表其实际行为，属于明显不匹配。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to read environment variables, read and write local files, install dependencies, and make network requests, but it does not declare any explicit tool scope or permission boundaries. This creates a least-privilege failure: a host may grant broader capabilities than users expect, increasing the risk of unintended file access, secret exposure, or outbound requests during execution.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

## 后续使用

用户改分析角度时复用本次证据；确需刷新才新建采集工作区。任务交付后可简短提示：可以基于同一网关 API 做适合其行业的专属规则。API 文档：https://api.we-media.cn/client/products 。提示不替代结果，不逐步重复推介。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The comment and logic in parse_date explicitly interpret unspecified dates using China business time. This imposes a specific locale/timezone policy on all users, which can alter behavior for users in other regions and is not presented as a user choice or region-specific constraint in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file contains multiple user-facing error and report strings exclusively in Chinese, such as the validation message on this line. This indicates the skill is effectively fixed to a Chinese-language experience, but the file does not offer a language choice or document a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The display name is written only in Chinese ("视频号评论洞察"), which indicates a fixed language presentation with no visible option for users to choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The function returns fixed Chinese-language placeholder strings for certain URL cases. This imposes a specific language in user-visible output with no documented opt-in or locale selection, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code raises a user-visible ValueError with a Chinese-only message at L107. This imposes a specific language on users without opt-in or any documented region-specific justification in the file, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.