公众号找号

• Outcome: Review
• Latest audit: Sep 4, 2026 · 9:17 AM UTC
• Version: 1.0.1

Overview

The skill mostly supports the advertised WeChat account lookups, but it also includes under-disclosed code that can upload local files to the provider and broader API metadata than the advertised purpose needs.

Review this skill before installing. It is suitable only if you trust the provider with your API key and query results. Do not pass `--file` or local media-path parameters to this skill, keep `config.json` out of shared folders or repositories, and prefer a version that removes the unused upload code, broad endpoint inventory, and shipped bytecode files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose is a narrow公众号搜索技能, but the behavior described by analysis indicates a more general API execution framework with billing, caching, pagination, file handling, and export/upload capabilities. That mismatch is dangerous because users may consent to a simple search skill while actually granting a broader operational surface that could invoke unintended endpoints, move data, or incur charges outside the expected task.

Ae1

High

• Category: analysis-evasion

Content

> 曼格云 skill ｜ 环节：找号 ｜ 底层统一底座 `wm_core.py`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Skill ships a __pycache__ directory that normal discovery skips

High

• Category: Supply Chain

Content

Python may load .pyc from this directory even when decoy .py sources look clean (PEP 552 UNCHECKED_HASH).

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill is described as a public-account search/profile tool, but the endpoint inventory exposes a much broader capability set including article extraction, video account analysis, media download/resolve, file upload, and AI analysis. This kind of scope mismatch violates least privilege and can enable unintended data collection, content extraction, and cross-domain use beyond the user-facing purpose, increasing abuse potential if the agent can invoke any listed endpoint.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: upload_file(path) accepts an arbitrary local path, reads the file from disk, and uploads its contents to remote storage. In the context of a公众号搜索 skill, there is no legitimate need to access arbitrary local files, so this creates a strong exfiltration risk if the function is invoked directly or indirectly by other skill logic or prompt-influenced tooling.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises executable behavior that uses environment access, local file read/write, and network calls, but it does not declare any explicit tool scope or permissions boundary. This weakens reviewability and can allow the skill to access more capabilities than a user or platform operator would reasonably expect, especially because it also handles credentials and writes files locally.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill tells the operator to place the user's API key into a local config.json file without any guidance on secure storage, access control, redaction, or cleanup. Storing secrets in plaintext on disk increases the risk of accidental disclosure through logs, backups, repository inclusion, or access by other local processes/tools.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This manifest-style JSON contains user-facing natural-language descriptions entirely in Chinese, including the compliance note at L014, but does not state that the skill is China-specific or provide any user opt-in for locale/language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
      "free": true,
      "internal": true,
      "note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
    },
    {
      "key": "account-balance",

• Confidence: 86% confidence
• Finding: The manifest includes a temporary file-upload capability that sends local files to cloud storage and returns a public URL for downstream AI processing. In the context of a skill whose stated purpose is searching public accounts, this is unnecessary and increases the risk of unintended local file exfiltration, especially if an agent can be induced to upload sensitive user-provided or workspace files.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
      "free": true,
      "internal": true,
      "note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
    },
    {
      "key": "account-balance",

• Confidence: 86% confidence
• Finding: The manifest includes a temporary file-upload capability that sends local files to cloud storage and returns a public URL for downstream AI processing. In the context of a skill whose stated purpose is searching public accounts, this is unnecessary and increases the risk of unintended local file exfiltration, especially if an agent can be induced to upload sensitive user-provided or workspace files.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
      "free": true,
      "internal": true,
      "note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
    },
    {
      "key": "account-balance",

• Confidence: 86% confidence
• Finding: The manifest includes a temporary file-upload capability that sends local files to cloud storage and returns a public URL for downstream AI processing. In the context of a skill whose stated purpose is searching public accounts, this is unnecessary and increases the risk of unintended local file exfiltration, especially if an agent can be induced to upload sensitive user-provided or workspace files.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

import urllib.parse
import hashlib

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The shared core module exposes a generic local-file upload primitive even though this skill’s stated purpose is only searching and viewing public account metadata. That creates capability drift: any downstream skill code importing this module can exfiltrate local files to an external service, expanding the attack surface far beyond what users would reasonably expect from this skill.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code uploads local file contents to external storage and only logs success/failure to stderr; it does not enforce a user-facing warning or consent check at execution time. For a skill whose manifest describes search/detail retrieval only, silent transmission of local data is especially risky because users would not expect any file export behavior.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.