视频号作品透视

• Outcome: Review
• Latest audit: Sep 4, 2026 · 9:26 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches a paid WeChat video lookup workflow, but it also contains an under-disclosed local-file upload path that can send files to a remote service even though the advertised endpoints do not need uploads.

Review before installing. The normal paid WeChat lookup flow is disclosed and requires confirmation, but do not pass local file paths, --file, videoUrl, or audioUrl unless you intend to upload that file to the provider. The publisher should remove bundled bytecode, remove unused endpoint catalog entries, and disable file upload behavior for this skill before it is treated as low-risk.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is narrowly framed as inspecting a single WeChat Channels post, but the behavior described by analysis is much broader: generic endpoint access, uploads, report generation, pagination, and billing/account operations. This mismatch weakens informed consent and reviewability, because a user may invoke the skill expecting simple parsing while the implementation can perform broader remote actions and handle billable operations.

Ae1

High

• Category: analysis-evasion

Content

> 曼格云 skill ｜ 环节：看内容 ｜ 底层统一底座 `wm_core.py`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Skill ships a __pycache__ directory that normal discovery skips

High

• Category: Supply Chain

Content

Python may load .pyc from this directory even when decoy .py sources look clean (PEP 552 UNCHECKED_HASH).

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is described as inspecting a single WeChat Channels video from a shared link, but the endpoint catalog exposes a much broader API surface including public account article retrieval, search, ranking, AI analysis, uploads, and account enumeration. This violates least privilege and creates capability expansion risk: an agent wired to this catalog could invoke unrelated endpoints to collect extra data, perform broader scraping, or exfiltrate content beyond the user's apparent request.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no explicit tool scope even though its documented workflow requires environment access, file reads/writes, and network calls. Without an allowlist or permissions block, the runtime may grant broader capabilities than users or reviewers expect, increasing the chance of unauthorized file access, key handling misuse, or unintended outbound requests.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file instructs the agent to relay a fixed Chinese message verbatim to the user and not rewrite it. This imposes a specific language on the interaction without any user opt-in or documented locale justification, which matches the language/locale policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This manifest is a natural-language configuration file, and multiple user-facing descriptive fields are provided exclusively in Chinese. Under the policy, forcing a specific language without offering user choice or documenting a justified locale restriction is a language/locale policy violation.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: A temporary file-upload ticket and public file URL capability is unnecessary for a skill whose purpose is to inspect a single shared video link. Even if marked internal, including it in the accessible endpoint catalog enables unintended data transfer to cloud storage and could be abused to upload local or user-provided files for later processing or exfiltration.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Search, account discovery, video listing, and live replay enumeration exceed the narrow purpose of inspecting one specific work from a supplied share link. These capabilities enable broader account profiling and collection of additional content unrelated to the user's request, increasing surveillance and scraping potential.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The AI video understanding and audio transcription endpoints go beyond returning existing metadata and interaction metrics for a shared WeChat Channels post. Their presence allows content extraction and deeper analysis of media, expanding the skill from metadata lookup into full media processing, which increases privacy, cost, and misuse risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script automatically uploads a user-supplied local file to a remote platform when --file is used or when videoUrl/audioUrl points to an existing local path. Although the comments mention temporary storage, there is no explicit execution-time warning or second confirmation specific to file exfiltration, so users may disclose sensitive local content to a third party unintentionally.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)

• Confidence: 96% confidence
• Finding: The script silently treats any non-URL value in videoUrl or audioUrl that matches a local file path as a file to upload. This implicit path-to-upload behavior is more dangerous than the explicit --file mode because a user may think they are passing an identifier or malformed URL, yet the program will exfiltrate a local file to remote storage without a clear warning.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)

• Confidence: 96% confidence
• Finding: The script silently treats any non-URL value in videoUrl or audioUrl that matches a local file path as a file to upload. This implicit path-to-upload behavior is more dangerous than the explicit --file mode because a user may think they are passing an identifier or malformed URL, yet the program will exfiltrate a local file to remote storage without a clear warning.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)

• Confidence: 96% confidence
• Finding: The script silently treats any non-URL value in videoUrl or audioUrl that matches a local file path as a file to upload. This implicit path-to-upload behavior is more dangerous than the explicit --file mode because a user may think they are passing an identifier or malformed URL, yet the program will exfiltrate a local file to remote storage without a clear warning.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The module-level description and user-facing messages are written entirely in Chinese, including onboarding, usage, and error/help text. For a general-purpose shared skill core, this imposes a language/locale constraint on users without any opt-in or stated region-specific justification.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

import urllib.parse
import hashlib

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The upload_file() path reads an arbitrary local file and uploads its full contents to a remote storage service, then returns a public HTTPS URL for downstream use. The code enforces size and MIME checks, but it does not present any explicit consent prompt, warning, destination disclosure, or allowlist at the point of upload, which creates a real exfiltration risk if higher-level skill logic passes user-supplied paths or sensitive local files.

Static analysis

No suspicious patterns detected.