Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly behaves like a paid WeChat Channel metrics tool, but it bundles broader API and file-upload capabilities that are not clearly disclosed for that purpose.
Review before installing. Only use this skill if you are comfortable giving it a WeMedia API key, storing that key locally, sending requested video identifiers to api.we-media.cn, and writing result/cache files on disk. Do not provide local file paths to this skill, and the publisher should remove the bundled upload and unrelated endpoint capabilities before this is treated as a narrow metrics-only skill.
> 曼格云 skill ｜ 环节：看数据 ｜ 底层统一底座 `wm_core.py`
Python may load .pyc from this directory even when decoy .py sources look clean (PEP 552 UNCHECKED_HASH).
Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.
Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.
"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
"free": true,
"internal": true,
"note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
},
{
"key": "account-balance","purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
"free": true,
"internal": true,
"note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
},
{
"key": "account-balance","purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
"free": true,
"internal": true,
"note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
},
{
"key": "account-balance",import urllib.parse import hashlib EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124 OFFICIAL = "https://api.we-media.cn" ROOT = "https://api.we-media.cn"
No suspicious patterns detected.