公众号情报分析系统

• Outcome: Review
• Latest audit: Sep 4, 2026 · 2:56 PM UTC
• Version: 1.0.1

Overview

The skill is a disclosed local WeChat public-account monitoring and export tool, with expected paid API use and local storage and no evidence of hidden credential theft or exfiltration.

Install this only if you want a Chinese-language WeChat public-account monitoring workflow using the Mangyun API. Keep MANGYUN_API_KEY in the environment, verify the workspace config uses the intended Mangyun endpoint, watch the budget controls before paid fetches, and treat generated JSON, dashboard, and Excel files as customer data because they can include article text, analysis, request IDs, balances, and errors.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

GatewayHandler.history_calls = 0
        self.temp = tempfile.TemporaryDirectory()
        self.workspace = Path(self.temp.name) / "workspace"
        self.env = os.environ.copy()
        self.env["MANGYUN_API_KEY"] = "test-key-never-persisted"
        self.env["MANGYUN_INTEL_TEST_ALLOW_HTTP"] = "1"
        self.env["PYTHONUTF8"] = "1"

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly instructs use of environment variables, local files, networking, and shell commands, but it does not declare any explicit tool/permission scope. That creates an authorization gap: an agent may invoke powerful capabilities without a documented least-privilege boundary, increasing the chance of unintended file access, network calls, or command execution in response to loosely related prompts. In this context, the risk is elevated because the workflow includes workspace initialization, API access, content fetching, and local serving.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The auto-trigger scope is broad enough to match many generic requests about monitoring, analysis, exports, dashboards, or briefs, which can cause the skill to activate in contexts the user did not intend. When a skill with network, file, and shell behaviors activates too eagerly, it can steer the agent into collecting data, creating files, or making external API calls without clear informed consent. The danger is higher here because the skill performs multi-step operational actions rather than offering passive guidance only.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: L49 instructs the skill to use concise Chinese output as a fixed requirement. This is a language-policy constraint expressed in natural language, and the file does not indicate user opt-in or offer alternative locales.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The default prompt is broadly phrased and can match many common user requests about monitoring, analysis, dashboards, and exports without clear boundaries on data sources, consent, or intended scope. In a skill that performs intelligence collection on public accounts, this increases the chance of overbroad or unintended invocation and can lead to privacy, compliance, or data-handling issues if the agent activates in contexts the user did not explicitly mean.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Enabling implicit invocation without a constrained trigger list allows the skill to activate based on loosely related requests, which is risky for a capability centered on multi-account monitoring, article collection, and customer-data export. The skill context makes this more dangerous because it touches surveillance-like workflows and data export operations, so mistaken activation could initiate sensitive analysis or collection beyond user intent.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The schema instructions require summaries and other text fields to be written in Chinese, as shown by the field examples and Chinese-only guidance throughout the file. This imposes a specific language/locale on users or downstream agents without any stated opt-in or justification, which matches the language policy violation criteria.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: `make_analysis_queue` writes article bodies, URLs, account metadata, prior-context summaries, and cross-account context into a JSON file on disk for later AI processing. In an agent-skill context this is a real data-exposure risk because sensitive collected content can be exported to a secondary artifact without an explicit consent prompt, redaction step, encryption, or warning that the file may be sent to another model or user-visible workspace.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The natural-language comments and behavior explicitly convert dates to Asia/Shanghai local days and much of the CLI/user-facing text is fixed in Chinese, with no user-selectable locale. That can violate language/locale policy when the skill is not clearly documented as region-specific or offering user choice.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file contains natural-language and formatting behavior that forces a specific locale: timestamps are converted to Asia/Shanghai, the dashboard HTML is declared as zh-CN, and client-side rendering uses toLocaleString('zh-CN'). This is a language/locale policy issue because the skill does not offer the user any opt-in or configuration choice for locale-specific presentation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

self.temp.cleanup()

    def exec_cli(self, *args: str, expect: int = 0):
        result = subprocess.run(
            [sys.executable, str(SCRIPT), "--workspace", str(self.workspace), *args],
            env=self.env, text=True, encoding="utf-8", capture_output=True,
        )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The display name, description, and default prompt are entirely in Chinese, and the file provides no indication that users may choose another language or locale. This can violate language-choice policy when a skill appears to assume a fixed language without explicit opt-in or documented regional justification.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: 文件标题及全文以中文给出强制性操作规范，但未说明这是仅适用于特定中文团队、地区合规场景，或允许用户选择其他语言。按规则，若技能在自然语言层面强制特定语言/locale 且无 opt-in，可构成组织语言策略违规。

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: This function imports structured AI-generated summaries, topics, risks, and related-account judgments directly into the persistent SQLite database. While this matches the tool's workflow, there is no explicit warning at import time that external AI output will overwrite or finalize local analytical records.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: This code writes a full HTML dashboard to disk and later exports an XLSX workbook containing article content, account metadata, error fields, request IDs, and billing/call history. The file performs these file-write operations without any visible confirmation prompt, logging, or inline disclosure to the user about what sensitive operational data will be persisted locally.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The workbook export includes a dedicated '调用成本' sheet populated from API call records, including request IDs, error codes, error messages, balances, and timestamps. Because this is a code file, the absence of any prompt, print/log statement, or inline warning means users are not explicitly informed that operational history and potentially sensitive diagnostics are being exported.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/api-contract.md:8