视频号数据罗盘

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 7:09 AM UTC
• Version: 1.4.2

Overview

This skill is a disclosed paid API helper for WeChat Channels metrics, with local exports and API-key use, but its description overstates whether a separate collection/favorite count is available.

Install only if you are comfortable using a paid third-party API, configuring WM_API_KEY locally, and exporting retrieved WeChat Channels data to local files. Before relying on reports, note that the skill may not provide a true independent 收藏/collection count even though the description mentions it; confirm the available fields and estimated cost before running paid queries.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about fetching and presenting exact interaction statistics for a WeChat Channels post. The supplied code does not access video metadata, parse engagement counts, distinguish exact versus displayed numbers, or interact with any metric source. Its sole function is sanitizing data structures by removing sensitive keys and redacting temporary or signed URLs. That is a materially different primary purpose, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description promises precise counts for 点赞、评论、收藏、转发、播放量 and labeling exact vs display values. The code does support exact-value normalization and display handling for several interaction fields, and it optionally preserves 播放量(viewCount). However, its core semantics explicitly distinguish 点赞 from 推荐, and it says there is no separate 收藏数 available from this interface ('本接口未提供独立收藏数'). That is a material mismatch because the declared purpose specifically claims to provide precise 收藏 data, while the implementation warns against inferring it. Additionally, the code’s primary implemented metric set is 点赞、转发、评论、推荐, not 点赞、评论、收藏、转发、播放 as declared. The extra profiling/ratio analysis is undeclared but secondary; the main mismatch is the missing promised 收藏 capability and the substituted 推荐 metric.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about obtaining exact interaction statistics for a specific video account item. However, the supplied code contains only infrastructure functions for platform contracts: building headers from client identity, listing products from /api/v1/products or /api/v1/public/products, computing price micros with parameter-based adjustments, validating API envelope failures, maintaining scoped snapshots, and estimating plan pricing. There is no logic to access video-channel content, no requests to video engagement endpoints, and no extraction of likes/comments/favorites/shares/views or exact-vs-display annotations. This is a clear purpose mismatch rather than mere supporting implementation detail.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This code chunk does not match the declared purpose as the primary behavior shown is an infrastructure layer, not a concrete implementation of retrieving exact engagement data for a specified video. The module reads endpoint metadata, manages authentication, estimates pricing, performs generic HTTP requests, retries on failures, paginates results, caches responses, normalizes certain channel-related responses, and formats outputs into multiple file types. While such a core could be used by a separate skill to obtain video interaction metrics, this chunk alone does not demonstrate the claimed specialized behavior of returning likes/comments/favorites/shares/views and labeling exact vs displayed values. The mismatch is therefore material: the actual code is a reusable backend framework with broader capabilities and a different primary purpose than the narrowly declared skill description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is a user-facing capability for retrieving exact interaction statistics for a specific video-channel post. However, the supplied code does not implement that functionality. Instead, it contains reusable backend helpers for request workflows and persistence: digest computation, safe JSON file writing/reading, lock management, custom API errors, and pagination state handling. Although there is an API origin constant and imports suggesting gateway/product infrastructure, there is no code here that requests a specific video's likes/comments/favorites/shares/play count, no parsing of such fields, and no exact-vs-display-value labeling. This is therefore a material mismatch in primary purpose and undeclared capabilities related to local storage and workflow control.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill clearly instructs use of environment variables, local file output, and outbound network access, but it does not declare any explicit tool scope or permissions boundaries. That creates an authorization gap where a host may grant broader capabilities than users expect, increasing the risk of unintended file access, network exfiltration, or unsafe execution paths.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s description and operating instructions are consistently presented only in Chinese, which effectively forces a specific language for users. The policy allows locale constraints only when user choice is offered or when the restriction is clearly documented and justified; neither is present here.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a skill focused on precise interaction metrics for WeChat Channel videos: likes, comments, favorites, shares, and views, including whether values are exact or abbreviated. However, this file also defines a separate ch-info endpoint whose purpose includes title, account, time, and media metadata, which goes beyond the manifest's narrowly described metrics-only function.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a narrowly scoped skill for reading precise engagement counts on a WeChat video. This file instead implements pricing/catalog access against api.we-media.cn, computes billable request costs, reads API keys, and persists snapshots to disk, which are not part of delivering interaction metrics and materially expand the skill's behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Fetching a product catalog and using it to estimate plan pricing is a separate operational capability from retrieving engagement metrics for a video. For a skill whose purpose is to show likes, comments, favorites, shares, and views, billing/catalog inspection is not an obvious requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring, usage text, and subsequent user-facing messages are entirely in Chinese, which imposes a fixed language on users. The file does not provide an opt-in, fallback language, or any documented reason that this skill must be Chinese-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This Python file contains its primary documentation and multiple CLI/user-facing strings exclusively in Chinese, which imposes a specific language on users. The file does not offer any opt-in language selection or explain that the skill is intentionally limited to a Chinese-only region or audience.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This shared core explicitly exposes capabilities far beyond the manifest's narrow purpose of fetching metrics for a specific WeChat video, including generic endpoint invocation, pagination, caching, pricing, and report/export functionality. In an agent-skill setting, this scope mismatch increases the blast radius: any wrapper skill using this core can access broader API surfaces or persist retrieved data to disk in ways users and reviewers may not expect.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/wm_core.py (reported line 33)May include surrounding context.

python

from workflow_core import atomic_json, digest, next_params, APIError, workspace_lock
from platform_contract import identity_headers, catalog, price_micros, failure, product_path

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module loads endpoint metadata from endpoints.json and builds a generic dispatcher that can call any listed endpoint, which is materially broader than the declared purpose of reading one video's interaction metrics. If another component or prompt-controlled wrapper can influence the endpoint key or parameters, the skill can be repurposed for unauthorized data access across multiple products, undermining least privilege and manifest-based trust.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest says this skill is for viewing precise interaction counts for a specific 视频号 item, but the module docstring describes broader capabilities: 'live prices, durable requests and evidence exports.' The implemented helpers support generic request/workflow infrastructure, local persistence, locking, and pagination rather than functionality specifically scoped to fetching and labeling interaction metrics.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The module docstring states the file provides 'live prices, durable requests and evidence exports,' but the code in this file only defines hashing, JSON read/write, workspace locking, an API error class, and pagination parameter handling. This is not merely incomplete documentation; it actively characterizes the module's purpose in terms that do not match the implemented logic here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The exception messages at L076 and L082 force a specific language for user-visible output. Under the policy, hard-coded locale-specific messaging is a violation unless the skill offers language choice or clearly documents a justified regional constraint, which this file does not.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest uses a Chinese-only display name ("视频号数据罗盘") with no indication that the skill is region-specific or that users can choose a preferred language. Under the policy, language constraints should be justified or optional rather than implicitly enforced.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code returns Chinese-language placeholder strings for certain sanitized URLs, which imposes a specific language in user-visible output. The file does not indicate any user opt-in, locale selection, or justification for enforcing Chinese text.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This JSON manifest contains user-facing natural-language fields such as endpoint names and purposes exclusively in Chinese, with no indication that the skill is region-specific or that users can choose a language/locale. Under the policy rules, forcing a specific language without opt-in is a natural-language policy issue.

Content

No source excerpt is available for this finding.