视频号直播回放台

• Outcome: Review
• Latest audit: Sep 4, 2026 · 9:33 AM UTC
• Version: 1.0.1

Overview

The skill largely supports the advertised WeChat live-replay queries, but it includes under-disclosed local file upload and data-retention behavior that should be reviewed before installation.

Review this skill before installing. Use it only if you trust the provider with a WeChat analytics API key and with returned replay data stored locally. Do not pass local file paths, --file, videoUrl, or audioUrl to this skill unless the upload behavior has been removed or explicitly approved. Clear config.json, output files, and scripts/.cache when you no longer need them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose is narrowly framed as querying live replay records, but the documented behavior includes a broader generic API framework, config/key handling, multi-format export, billing flows, caching, and other generalized capabilities. This mismatch weakens user consent and reviewability because operators may approve a narrowly described skill that in practice can perform materially broader actions, including writing files and invoking paid endpoints.

Ae1

High

• Category: analysis-evasion

Content

> 曼格云 skill ｜ 环节：看数据 ｜ 底层统一底座 `wm_core.py`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Skill ships a __pycache__ directory that normal discovery skips

High

• Category: Supply Chain

Content

Python may load .pyc from this directory even when decoy .py sources look clean (PEP 552 UNCHECKED_HASH).

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The endpoint catalog exposes a broad set of capabilities far beyond the declared skill purpose of listing and inspecting 视频号直播回放. This violates least privilege and creates an unnecessary attack surface: if the skill or an upstream agent can invoke arbitrary listed endpoints, it could access unrelated content sources, search/discovery functions, and media-processing features that users did not consent to when invoking this skill.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The manifest includes numerous unrelated scraping, search, account profiling, article extraction, and discovery endpoints for 公众号, 小程序, 热搜, and other datasets. For a skill advertised as live-replay lookup, this mismatch materially increases the chance of overcollection, misuse of unrelated datasets, and covert expansion into reconnaissance or scraping activities beyond user expectations.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code can upload any local file path to an external service via a signed upload ticket and multipart POST, which is a direct arbitrary file exfiltration primitive. In a query-oriented skill whose stated purpose is replay lookup and analytics, that capability is not justified by the business context and significantly raises the danger of abuse through prompt/agent chaining, compromised wrappers, or future maintenance mistakes.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares executable behavior involving environment access, local file read/write, and network calls, but does not define any explicit tool scope such as allowed tools or permissions. That creates an overprivileged execution model where the runtime may grant broader capabilities than users would reasonably infer from the skill description, increasing the chance of unintended data exposure or misuse.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The skill metadata, instructions, user-facing scripted text, and operational guidance are entirely written to be delivered in Chinese, including the requirement to quote specific Chinese wording back to the user. This indicates a fixed language behavior without any documented user opt-in or alternative locale choice, which is a natural-language policy concern under the language/locale rule.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file upload ticket endpoint allows local files to be transferred to temporary cloud storage and converted into public URLs, which is unrelated to replay lookup. In this skill context, that capability can facilitate unintended data exfiltration or staging of user-provided local content to external infrastructure without a clear business need.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
      "free": true,
      "internal": true,
      "note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
    },
    {
      "key": "account-balance",

• Confidence: 94% confidence
• Finding: The upload helper note explicitly describes obtaining a cloud upload ticket and pushing local files to object storage, producing a public URL. In the context of a replay-query skill, this is dangerous because it provides a ready-made exfiltration path for local or user-supplied files to external storage, despite being unnecessary for the advertised functionality.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
      "free": true,
      "internal": true,
      "note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
    },
    {
      "key": "account-balance",

• Confidence: 94% confidence
• Finding: The upload helper note explicitly describes obtaining a cloud upload ticket and pushing local files to object storage, producing a public URL. In the context of a replay-query skill, this is dangerous because it provides a ready-made exfiltration path for local or user-supplied files to external storage, despite being unnecessary for the advertised functionality.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
      "free": true,
      "internal": true,
      "note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
    },
    {
      "key": "account-balance",

• Confidence: 94% confidence
• Finding: The upload helper note explicitly describes obtaining a cloud upload ticket and pushing local files to object storage, producing a public URL. In the context of a replay-query skill, this is dangerous because it provides a ready-made exfiltration path for local or user-supplied files to external storage, despite being unnecessary for the advertised functionality.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The AI video-understanding and audio-transcription endpoints introduce media analysis powers not required to merely retrieve live replay records and metrics. In practice, they expand the skill from metadata access into content processing, which can increase privacy exposure, cost abuse, and the chance that user or third-party media is sent to additional processing systems without clear necessity.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module docstring and user-facing usage text are entirely in Chinese, and later console messages in the script are also Chinese-only. This can violate a language/locale policy when a skill forces one language without user opt-in and does not state that it is intentionally region-specific.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

import urllib.parse
import hashlib

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The shared core exposes an upload_file() capability that can exfiltrate arbitrary local files to a remote storage service, even though this skill is described only as listing and inspecting livestream replay data. That mismatch materially increases risk: if any caller, wrapper, or future code path invokes this helper on attacker-influenced paths, local sensitive files could be uploaded off-host without user intent.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: This JSON manifest uses a China-specific API domain and all human-readable descriptions are in Chinese, but it does not document that the skill is region-specific or offer any user opt-in for language/locale constraints. Under the natural-language policy rule, forcing a specific language/locale without explicit justification can be a policy concern.

Static analysis

No suspicious patterns detected.