Security audit
Security checks across malware telemetry and agentic risk
The skill mostly performs the advertised paid WeChat mini-program search, but it also ships broader API metadata and a local-file upload path that are not needed or clearly disclosed for that purpose.
Review before installing. Use only with a trusted API key and avoid passing --file or local paths. The publisher should remove unrelated endpoints, remove the upload helper from this skill, and omit __pycache__ files before this is treated as a clean narrow mini-program-search skill.
> 曼格云 skill ｜ 环节：找号 ｜ 底层统一底座 `wm_core.py`
Python may load .pyc from this directory even when decoy .py sources look clean (PEP 552 UNCHECKED_HASH).
Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.
Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.
"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
"free": true,
"internal": true,
"note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
},
{
"key": "account-balance","purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
"free": true,
"internal": true,
"note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
},
{
"key": "account-balance","purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
"free": true,
"internal": true,
"note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
},
{
"key": "account-balance",import urllib.parse import hashlib EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124 OFFICIAL = "https://api.we-media.cn" ROOT = "https://api.we-media.cn"
VirusTotal findings are pending for this skill version.
No suspicious patterns detected.