热点选题雷达

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 6:12 AM UTC
• Version: 1.4.2

Overview

The skill is a Chinese-language hot-topic research helper that calls a disclosed We-Media API with user-controlled parameters and cost confirmation, without hidden persistence or unrelated destructive behavior.

Install only if you are comfortable using a Chinese-language workflow that sends your selected topics, filters, and API-authenticated requests to api.we-media.cn. Review the displayed cost estimate before authorizing --yes, and choose output, snapshot, or checkpoint paths intentionally because local files may be created or replaced at those paths.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says the skill helps users discover trending topics and content ideas from multiple platforms. However, the provided code does not fetch hot searches, analyze content trends, generate keyword suggestions, or interact with the named platforms in any content-discovery way. Instead, it implements a safety helper for filtering sensitive data and redacting signed or temporary URLs, especially for WeChat-related links. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是一个面向内容运营的热点/选题发现工具，应涉及热搜榜、爆文榜、关键词联想等数据获取或整理。但提供的代码完全没有实现这些能力，也没有访问微博/抖音/知乎/头条/百度等平台数据。相反，代码专注于微信视频号（Finder）互动指标的语义标准化、显示与分析，属于视频互动数据处理模块，与“选题灵感雷达”的主要用途明显不符，因此构成显著描述-行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description presents an end-user content ideation tool focused on hot-topic discovery and keyword expansion across social/content platforms. The code shown does something materially different: it provides backend infrastructure for interacting with an API marketplace/catalog, validating response envelopes, estimating per-call pricing, and safely writing snapshots. There is no logic for querying Weibo/Douyin/Zhihu/Toutiao/Baidu trends, no low-follower viral content analysis, and no keyword suggestion retrieval. This is a clear description-behavior mismatch, with the code serving operational/API-contract and pricing functions unrelated to the declared feature.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is for a specific end-user feature: discovering hot topics, trending searches, low-follower viral posts, and keyword suggestions across major platforms. The supplied code chunk does not implement those domain-specific functions. Instead, it is an infrastructure module ('统一底座') shared by many skills, providing generic request/authentication, fee estimation, pagination, retries, cache, billing output, and file formatting. While such a core library could support the declared skill, this chunk alone materially differs in primary purpose and capabilities from the declared description. No clearly malicious or unrelated data exfiltration is visible, but the code is not accurately represented as the specific topic-radar functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description promises a user-facing热点选题/热搜榜/联想词 capability. However, the supplied code chunk is backend utility code for durable workflow execution: it writes and reads JSON files, sanitizes exported data, manages cross-process locks, defines an APIError type, and computes next-page parameters for paginated APIs. While such utilities could support a larger hot-topic skill, this snippet itself does not demonstrate the declared core behavior (fetching platform hot lists, low-follower viral articles, or keyword suggestions). It also includes undeclared capabilities around local persistence and locking, which are infrastructure-oriented and materially different from the advertised purpose in this code segment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares operational behavior that uses environment variables, local file I/O, and outbound network access, but it does not declare an explicit tool/permission scope. This creates a least-privilege and transparency gap: a host may grant broader capabilities than users expect, and reviewers cannot easily verify whether execution is constrained to only the needed resources.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This Python file contains its top-level module documentation entirely in Chinese and later emits user-facing CLI/help/error strings in Chinese, indicating the skill experience is fixed to a specific language. Under the policy, forcing a locale without user opt-in is a natural-language policy violation unless a justified region-specific constraint is documented, which is not present here.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/wm_core.py (reported line 33)May include surrounding context.

python

from workflow_core import atomic_json, digest, next_params, APIError, workspace_lock
from platform_contract import identity_headers, catalog, price_micros, failure, product_path

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest's human-facing display name is only provided in Chinese, which can indicate a language/locale constraint without user opt-in. For a general skill manifest, this may conflict with organizational language-choice policy unless the skill is explicitly documented as China/Chinese-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The returned placeholder strings "[临时视频链接仅在采集内存中使用]" and "[临时资源地址未保存]" are natural-language outputs that force a specific language. This can violate language/locale policy when the skill does not provide user opt-in or explain that it is intentionally region- or locale-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This JSON config uses Chinese-only natural-language values such as endpoint names and purposes (for example at L011, L021, L032, L063, L095, and L103). Because the file provides no user opt-in, alternative locale, or justification that the skill is intentionally China-region-specific, it may violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The raised ValueError at L109 contains only Chinese text, which imposes a specific language on users of this shared utility. The file does not indicate that the skill is region-specific or provide any opt-in or fallback language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code raises user-visible ValueError messages in Chinese at L076 and L082. This imposes a specific language on users without any opt-in, fallback, or documented justification, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.