热点选题雷达

• Outcome: Review
• Latest audit: Sep 4, 2026 · 9:31 AM UTC
• Version: 1.0.1

Overview

This topic-radar skill mostly matches its purpose, but it includes an under-disclosed local-file upload path and broader shared API surface that users should review before installing.

Review before installing. Use only if you are comfortable storing a We-Media API key in local config.json and sending queries/results to api.we-media.cn. Do not use --file with this skill unless the publisher fixes the upload flow and discloses it clearly. The publisher should remove bundled bytecode, remove or isolate unused upload/media endpoints, and implement the documented cache expiry.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is described as a topic-discovery tool, but the content indicates broader infrastructure capabilities including generic remote API invocation, local file export, possible file upload behavior, billing/consumption handling, and caching. This mismatch is dangerous because users may grant trust based on the narrow description while the skill actually performs additional actions involving external data transfer, local persistence, and paid operations that are not transparently disclosed.

Ae1

High

• Category: analysis-evasion

Content

> 曼格云 skill ｜ 环节：找方向 ｜ 底层统一底座 `wm_core.py`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Skill ships a __pycache__ directory that normal discovery skips

High

• Category: Supply Chain

Content

Python may load .pyc from this directory even when decoy .py sources look clean (PEP 552 UNCHECKED_HASH).

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares executable behavior that touches environment variables, local file read/write, and outbound network access, but it does not declare any explicit tool scope or permission boundaries. This is dangerous because operators and users cannot verify what resources the skill is allowed to access, and the workflow includes writing API keys to config.json and making remote API requests, which increases the risk of unintended secret exposure or over-broad execution.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The manifest fields, instructions, and user-facing scripted text are entirely in Chinese, and the skill tells the agent to relay fixed Chinese wording to the user verbatim. There is no indication that the user can opt into another language or that the locale restriction is required for a region-specific compliance purpose.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: This manifest-like JSON contains user-facing natural-language fields such as "excluded_reason", "name", "purpose", and "note" entirely in Chinese, which effectively imposes a single language/locale. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy violation.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The temporary file upload ticket enables local files to be transferred to remote cloud storage and converted into public URLs, even though file handling is not necessary for a topic-radar workflow. In a skill context, this creates an unnecessary exfiltration path for user-supplied local content and broadens the data boundary without a clear, proportional business need.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
      "free": true,
      "internal": true,
      "note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
    },
    {
      "key": "account-balance",

• Confidence: 96% confidence
• Finding: The note explicitly describes a helper that uploads local files to external object storage and returns a publicly accessible URL for downstream AI endpoints. In an agent skill, this is a classic exfiltration primitive: local user files can leave the trusted environment and become remotely accessible, which is more dangerous because the advertised skill purpose does not justify handling local files at all.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
      "free": true,
      "internal": true,
      "note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
    },
    {
      "key": "account-balance",

• Confidence: 96% confidence
• Finding: The note explicitly describes a helper that uploads local files to external object storage and returns a publicly accessible URL for downstream AI endpoints. In an agent skill, this is a classic exfiltration primitive: local user files can leave the trusted environment and become remotely accessible, which is more dangerous because the advertised skill purpose does not justify handling local files at all.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
      "free": true,
      "internal": true,
      "note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
    },
    {
      "key": "account-balance",

• Confidence: 96% confidence
• Finding: The note explicitly describes a helper that uploads local files to external object storage and returns a publicly accessible URL for downstream AI endpoints. In an agent skill, this is a classic exfiltration primitive: local user files can leave the trusted environment and become remotely accessible, which is more dangerous because the advertised skill purpose does not justify handling local files at all.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is presented as a 'hot-topic/topic radar' tool, but the endpoint inventory exposes a much broader surveillance and extraction surface: account/article scraping, full content retrieval, media extraction, video-channel lookup, and AI analysis. This scope expansion increases the chance that the skill can be repurposed to collect or process content far beyond the user's expected use case, undermining least privilege and informed consent.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Video understanding and audio transcription let the skill process arbitrary media content, including OCR and speech extraction, which is materially broader than discovering trending topics or keyword ideas. These capabilities can expose sensitive content embedded in media and create a hidden ingestion channel for data unrelated to the stated purpose of the skill.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

import urllib.parse
import hashlib

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The manifest describes a skill for discovering trending topics, hot-search rankings, low-follower viral content, and keyword expansion. This core module additionally uploads arbitrary local files to remote temporary storage and returns public HTTPS URLs, which is a materially different capability not justified by the stated purpose of topic discovery.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The upload_file() helper transmits full local file contents to remote object storage once invoked, but the function itself provides no user-facing consent prompt, disclosure, or policy guardrail. In a hot-topic discovery skill, this capability is not obviously necessary, so hidden or poorly surfaced uploads increase the risk of unintended data disclosure if another component calls it.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The module-level description and all user-facing guidance/messages are written in Chinese, including setup, billing, and error instructions, with no indication that another language can be used. This can violate language/locale policy when the skill is expected to support users without forcing a specific language absent opt-in or documented regional scope.

Context-Inappropriate Capability

Low

• Confidence: 76% confidence
• Finding: For a skill presented as a content-idea radar, reading API keys from local config files and environment variables is an infrastructural capability not reflected in the manifest's stated end-user purpose. While common in shared SDK code, this capability is still broader than the manifest communicates for this specific skill.

Static analysis

No suspicious patterns detected.