视频号作品透视

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 6:12 AM UTC
• Version: 1.4.2

Overview

This skill is a disclosed wrapper around a WeChat Channels data API, with expected API-key use, paid-call confirmation, and local result exports.

Install only if you are comfortable using the WeMedia API service, configuring WM_API_KEY locally, and sending WeChat Channels links or IDs to api.we-media.cn for paid lookup. Review estimated cost before using --yes and choose output paths intentionally because results are saved locally.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied code is narrowly focused on interaction metrics semantics for Finder/WeChat Channels responses. It defines helpers to preserve exact integer counts, normalize metric key mappings between legacy and canonical fields, package interaction-basis data, format metric display values, total interactions, infer a simple interaction profile, and recursively normalize nested gateway channel structures. This is only a subset of the declared interaction-data portion of the description, and even there it mainly remaps/validates metrics rather than retrieving them from a shared link. There is no code handling URL parsing, network retrieval, title/account/timestamp/cover/media extraction, objectId-shortlink conversion, or link generation. Therefore the actual code chunk does not accurately represent the broad declared purpose and has a materially narrower primary function.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This code chunk’s primary purpose is infrastructure for platform contract/pricing management, not analysis of a single 视频号作品. It interacts with product catalog and pricing endpoints, calculates billing adjustments, and manages snapshots. None of the declared end-user capabilities—resolving a share link, extracting title/account/time/cover/media/engagement data, or converting objectId and short links—appear in this code. This is a material description-behavior mismatch, not merely supporting implementation detail.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description is for a specific business function focused on one WeChat Channels post. However, this code chunk is infrastructure code (wm_core.py) that provides common plumbing across many skills: config/key loading, request headers, pricing estimates, HTTP calls, retries, cache, pagination, and file export. No code here specifically parses a 视频号 share link, extracts title/account/time/cover/media/metrics, or performs objectId/short-link/share-link conversion. While such a generic core could support the declared skill as a dependency, the supplied chunk's actual behavior is materially broader and different from the stated end-user purpose, so this chunk does not accurately represent that description on its own.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description is for a specific skill that parses one video-share item and exposes its metadata and link/objectId conversions. The actual code shown is infrastructure code for durable workflows and API handling. It performs undeclared local file operations and locking, and only contains generic helpers rather than the claimed content-parsing behavior. While such utilities could support a larger implementation, this chunk itself does not match the stated primary purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to use environment variables, local file I/O, and network access, but it does not declare any explicit tool scope or permission boundaries. This creates an over-privileged execution model where a host may grant broader capabilities than the task actually needs, increasing the risk of unintended data access or exfiltration if the skill or surrounding tooling is compromised.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file defines multiple natural-language labels and notes entirely in Chinese, such as interaction labels and explanatory text, and later uses them in returned data and error messaging. Because the file provides no opt-in, fallback, or justification that the skill is intentionally restricted to a Chinese-language context, this appears to force a specific language/locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language instructions that force a specific language for usage and interaction. The policy allows locale constraints only when they are optional or clearly documented and justified; here there is no opt-in or explanation that the skill is intentionally Chinese-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This Python file contains core user-facing instructions, status messages, and CLI help entirely in Chinese, establishing a default language behavior for the skill. The file does not offer language selection or explain that the skill is intentionally limited to a Chinese-speaking audience, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/wm_core.py (reported line 33)May include surrounding context.

python

from workflow_core import atomic_json, digest, next_params, APIError, workspace_lock
from platform_contract import identity_headers, catalog, price_micros, failure, product_path

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a skill for parsing a WeChat Channel shared link into metadata such as title, account, publish time, cover, media, and interaction data. This module instead presents itself as a generic 'portable gateway workflow' layer with durable request handling, evidence exports, workspace locking, generic pagination helpers, and JSON persistence, which is broader infrastructure behavior than the narrowly described video-insight function.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code raises a visible error message in Chinese at L076 and L082 (此工作区已有任务运行，请等待完成) with no indication that the skill is intentionally China-specific or that users can choose their language. This creates a natural-language locale policy concern because the file enforces a specific language in user-facing output without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The function returns user-visible placeholder strings in Chinese only: "[临时视频链接仅在采集内存中使用]" and "[临时资源地址未保存]". This hard-codes a specific language/locale in natural-language output without offering user choice or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This JSON manifest defines skill capabilities and endpoints but provides no trigger phrases, activation boundaries, or exclusion conditions. For manifest files, the absence of any specificity about when the skill should activate can lead to overly broad or unintended invocation by surrounding tooling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest uses Chinese natural-language strings for names and purposes throughout, which can amount to a fixed-language experience if surfaced directly to users. There is no indication that users can opt into this locale or that the skill is intentionally limited to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The ValueError message is emitted only in Chinese and there is no mechanism to adapt it to the user's language or environment. This is a natural-language policy concern because operational feedback is language-constrained without opt-in or documented locale limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The exception text at L109 is hard-coded in Chinese, which imposes a specific language on users without offering a locale choice or documenting a justified region-specific constraint. This matches the policy category for language or locale violations in natural-language content embedded in code.

Content

No source excerpt is available for this finding.