微信生态数据台

• Outcome: Review
• Latest audit: Sep 4, 2026 · 9:13 AM UTC
• Version: 1.0.1

Overview

The skill connects to a WeChat data API, but it overstates its working capabilities and includes under-controlled local file upload and API key handling that users should review before installing.

Install only if you intend to use the 曼格云/api.we-media.cn service and are comfortable giving it an API key. Treat the key stored in config.json as plaintext, review or remove the bundled __pycache__ files, and avoid passing local file paths unless you explicitly want those files uploaded to the remote service. The current executable appears to support only account balance lookup despite the broader endpoint list in the documentation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The description presents a comprehensive data assistant covering many WeChat ecosystem APIs and automatic routing/orchestration. The supplied code does not match that scope. Its ENDPOINTS list contains only 'account-balance', and the command flow requires the caller to specify an endpoint directly. There is no natural-language intent parsing, no endpoint selection logic, and no implementation of the numerous advertised data retrieval/analysis functions. The fee-estimate-before-execution behavior is present and consistent with the description, but the primary claimed functionality is materially overstated relative to this code chunk.

Ae1

High

• Category: analysis-evasion

Content

> 曼格云 skill ｜ 环节：平台入口 ｜ 底层统一底座 `wm_core.py`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Skill ships a __pycache__ directory that normal discovery skips

High

• Category: Supply Chain

Content

Python may load .pyc from this directory even when decoy .py sources look clean (PEP 552 UNCHECKED_HASH).

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill describes capabilities that include reading environment state, writing configuration files, and making network calls, but it does not declare any explicit tool scope or allowed-tools boundaries. This weakens least-privilege controls and makes it harder for the host or reviewer to constrain what the skill may access, increasing the blast radius if the skill is misused or later modified.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The usage description says to use the skill whenever a user wants to query 'any WeChat ecosystem data' or when the requirement is unclear and the system should auto-select an interface. That trigger scope is extremely broad and lacks exclusion conditions or negative examples, increasing the chance of unintended invocation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs storing a user API key in a local `config.json` file without warning about plaintext credential storage, file permissions, lifecycle, or exposure to other tools/users on the system. Because this skill is explicitly network-enabled and writes files, insecure local storage of a live API credential can lead to credential theft, unauthorized API usage, billing abuse, and possible access to a user's account data.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The manifest describes a comprehensive assistant that can automatically choose and orchestrate interfaces for公众号、视频号、搜一搜、微信指数、热搜、小程序、AI分析等, including cost estimation before paid calls. In this file, the only declared endpoint is 'account-balance', so the implemented behavior is far narrower than the claimed capability.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script automatically uploads local files to a remote platform when --file is used or when certain parameter values happen to be local paths, but it does not present an explicit user-facing transmission warning or require separate confirmation for the upload step. In a data-query skill handling potentially sensitive media, this increases the chance of unintended disclosure of local content to a third-party service.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)

• Confidence: 93% confidence
• Finding: This branch is riskier because it implicitly treats any non-URL string pointing to an existing local file as an upload candidate and silently transmits it to cloud storage. That behavior can surprise users and enables accidental exfiltration of arbitrary local files if a parameter is populated with a filesystem path.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)

• Confidence: 93% confidence
• Finding: This branch is riskier because it implicitly treats any non-URL string pointing to an existing local file as an upload candidate and silently transmits it to cloud storage. That behavior can surprise users and enables accidental exfiltration of arbitrary local files if a parameter is populated with a filesystem path.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)

• Confidence: 93% confidence
• Finding: This branch is riskier because it implicitly treats any non-URL string pointing to an existing local file as an upload candidate and silently transmits it to cloud storage. That behavior can surprise users and enables accidental exfiltration of arbitrary local files if a parameter is populated with a filesystem path.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: Natural-language strings in the module docstring and later user-facing guidance force a single language/locale experience. Under the stated policy, language constraints should either be optional via user choice or clearly documented as a justified region-specific limitation.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

import urllib.parse
import hashlib

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The key acquisition instructions are directly shown to users and are only available in Chinese, which imposes a language policy without offering alternatives. This can violate organizational locale requirements unless the skill is explicitly scoped to a Chinese-only audience.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The upload_file() function reads an arbitrary local file and transmits its full contents to a remote upload URL, but the operation point itself does not enforce an explicit user confirmation or warning about data exfiltration. In an agent setting, this is dangerous because a higher-level workflow could cause sensitive local files to be uploaded off-host without the user fully understanding that the contents leave the local environment.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The file hard-codes a China-specific API domain and uses Chinese-only natural-language descriptions and policy text, including the exclusion rationale. This creates an implicit locale constraint without any explicit user opt-in or documented language choice, which matches the policy-violation category for forced language/locale behavior.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.