视频号找号

• Outcome: Review
• Latest audit: Sep 4, 2026 · 9:31 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches a paid WeChat video-channel lookup tool, but it bundles and exposes under-disclosed local-file upload behavior that is not needed for that purpose.

Install only if you trust the provider and are comfortable sending lookup queries and returned data through api.we-media.cn. Do not pass --file, videoUrl, audioUrl, or local filesystem paths to this skill unless the upload behavior has been removed or explicitly confirmed. Treat config.json and cached/output files as sensitive because they may contain the API key or paid API results, and be careful with --pages because multi-page runs may cost more than the displayed estimate.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is a narrow video-account search workflow, but the documented behavior suggests a broader reusable remote API framework with file generation, caching, pagination, billing-related output, and even temporary file upload support. This mismatch weakens user and platform trust boundaries because operators may approve the skill for a narrow use case while it actually enables more expansive data movement and remote operations.

Ae1

High

• Category: analysis-evasion

Content

> 曼格云 skill ｜ 环节：找号 ｜ 底层统一底座 `wm_core.py`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Skill ships a __pycache__ directory that normal discovery skips

High

• Category: Supply Chain

Content

Python may load .pyc from this directory even when decoy .py sources look clean (PEP 552 UNCHECKED_HASH).

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The endpoint catalog exposes many capabilities unrelated to the declared skill purpose of keyword-based 视频号 account/work search, including公众号 scraping, article extraction, media analysis, upload, download, and link generation. Overbroad capability exposure increases attack surface and creates a privilege mismatch where an agent invoking this skill could access or process data far beyond user expectations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no explicit tool scope even though its documented behavior requires environment access, local file reads/writes, and outbound network calls. Without a least-privilege permission boundary, an agent may grant broader capabilities than users expect, increasing the chance of unintended data access, secret handling, or arbitrary remote interactions through the underlying script.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation guidance is broad ('use when the user wants to search accounts or related works by keyword') and lacks exclusions or tighter triggers. Over-broad activation can cause the skill to run in marginal contexts, unnecessarily invoking networked, billable, and file-writing behavior when a simpler or safer response would suffice.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This manifest-like JSON uses Chinese for key natural-language fields such as excluded_reason, name, purpose, and note throughout the file. Because the file does not offer any language/locale choice or document a justified region-specific constraint, it appears to impose a specific language by default, which matches the language/locale policy violation criteria.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: A temporary file upload ticket and associated AI-ingestion workflow are not necessary for a search-only skill and enable arbitrary local file transfer to external cloud storage. In an agent setting, this can be repurposed to exfiltrate user-provided or locally accessible files under the guise of normal skill operation.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
      "free": true,
      "internal": true,
      "note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
    },
    {
      "key": "account-balance",

• Confidence: 91% confidence
• Finding: The manifest explicitly describes uploading local files to platform-controlled temporary public storage to obtain a URL consumable by AI endpoints. Even if intended for convenience, this is a classic exfiltration primitive because it converts local content into externally hosted data accessible outside the original environment.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
      "free": true,
      "internal": true,
      "note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
    },
    {
      "key": "account-balance",

• Confidence: 91% confidence
• Finding: The manifest explicitly describes uploading local files to platform-controlled temporary public storage to obtain a URL consumable by AI endpoints. Even if intended for convenience, this is a classic exfiltration primitive because it converts local content into externally hosted data accessible outside the original environment.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
      "free": true,
      "internal": true,
      "note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
    },
    {
      "key": "account-balance",

• Confidence: 91% confidence
• Finding: The manifest explicitly describes uploading local files to platform-controlled temporary public storage to obtain a URL consumable by AI endpoints. Even if intended for convenience, this is a classic exfiltration primitive because it converts local content into externally hosted data accessible outside the original environment.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Playback/download URL retrieval and share-link generation extend the skill from search into content access and redistribution. Those capabilities can facilitate unauthorized media retrieval, repackaging, or dissemination that is outside the declared search-only purpose and increases legal and security risk.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module docstring presents usage instructions exclusively in Chinese, and later user-facing output is also Chinese-only. This enforces a specific language experience without offering the user a language or locale choice, which matches the language/locale policy violation criteria.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

import urllib.parse
import hashlib

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This shared core exposes an arbitrary local file upload primitive that can send any caller-specified file to a remote service, even though the stated skill purpose is only keyword-based search for 视频号 accounts and works. In an agent setting, unrelated upload capability broadens the attack surface and can enable unintended exfiltration of local data if higher-level skill logic or prompt handling passes attacker-influenced file paths into this function.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The upload entry point reads local file contents and transfers them to a remote endpoint without any explicit user warning or consent check at the point of action. In an agent/skill environment, this is dangerous because a user may believe they are only performing keyword search, while hidden or indirect code paths could cause sensitive local files to be transmitted externally.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The top-level module documentation and user-facing guidance strings are entirely in Chinese, and the file does not offer a language choice or indicate that Chinese is a documented, justified locale constraint. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This code reads the WM_API_KEY from local config files and the WM_API_KEY environment variable, which is access to credential material. While the module has internal comments/docstrings, there is no explicit user-facing warning or disclosure when the skill accesses stored credentials during normal operation.

Static analysis

No suspicious patterns detected.