Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
声明描述的是“搜索和查看公众号资料”的检索类能力，但提供的代码并未执行任何搜索、查询公众号、返回账号名称/简介/微信号/认证主体，或查看详细资料的逻辑。实际代码的主要用途是对数据进行递归脱敏与安全化处理，避免持久化凭证、临时链接和签名资源地址。这属于与声明功能明显不同的实现内容，而不是单纯的底层辅助细节，因此应判定为描述与行为不匹配。
- Content
Security audit
公众号找号
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed WeMedia API client for searching WeChat public accounts, with cost estimation before paid calls and local result exports.
Install only if you are comfortable using the WeMedia service, configuring a local WM_API_KEY, and sending search/profile query parameters to api.we-media.cn. Review cost estimates before using --yes, keep --pages modest, and choose output/snapshot paths deliberately because files may be written or replaced locally.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是“按关键词搜索公众号并查看公众号资料”的检索类能力，目标对象是微信公众号账号资料。实际代码完全没有搜索、关键词处理、公众号账号信息抓取、名称/简介/微信号/认证主体返回、或公众号详情查看等逻辑。相反，它专注于微信视频号互动指标的口径统一与分析，包括 favorite/like/recommend 字段映射、精确计数校验、显示文案处理、互动结构推断等。这属于 materially different primary purpose，且实现能力与声明场景无关，因此应判定为明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向微信公众号检索与详情查看的技能，核心能力应是按关键词/行业搜索公众号并返回账号信息。但实际代码完全没有与公众号搜索、关键词检索、账号详情抓取相关的逻辑，也未见对应接口调用。相反，代码主要围绕开放平台产品目录、价格计算、请求头身份标识、响应错误封装检查，以及结果快照管理展开，且主入口是对JSON调用计划进行费用估算。这属于与声明主用途 materially different 的行为，因此应判定为明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个面向终端用户的具体业务技能：按关键词搜索公众号并查看详情。但提供的代码块并未体现任何与“公众号搜索”“公众号详情展示”直接相关的业务参数、端点选择或结果字段处理。相反，它是一个可复用的底层通用组件，支持读取配置、要求 API Key、进行任意已配置端点的请求、重试、分页、缓存和格式化输出。虽然这种底座代码可能被公众号搜索技能复用，但仅从该代码块本身看，其实际行为范围明显大于且不同于声明的单一用途，因此属于描述与代码行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个面向公众号检索与详情查看的业务技能，应看到关键词搜索、公众号资料字段解析、详情接口调用等代码。但当前代码仅包含底层基础设施函数，如 digest、atomic_json、read_json、workspace_lock、APIError、next_params，以及一个 API 根地址常量，主要用途更接近通用工作流/请求处理框架。虽然这些能力可能作为某个技能的支撑组件存在，但在该代码片段中没有任何与“公众号搜索账号、返回名称简介微信号认证主体、查看详细资料”直接相关的业务实现，因此该描述与实际代码行为存在明显不匹配。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill clearly instructs use of environment variables, local file I/O, and outbound network access, but it does not declare any explicit tool scope or permission boundaries. This creates an over-privileged, weakly governed execution model where a host may grant broader capabilities than users expect, increasing the chance of unintended data access or exfiltration.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。
text 文档入口：https://api.we-media.cn/client/ai-guide API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products 公开产品目录：GET https://api.we-media.cn/api/v1/public/products 配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。
text 文档入口：https://api.we-media.cn/client/ai-guide API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products 公开产品目录：GET https://api.we-media.cn/api/v1/public/products 配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。
text 文档入口：https://api.we-media.cn/client/ai-guide API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products 公开产品目录：GET https://api.we-media.cn/api/v1/public/products 配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。
text 文档入口：https://api.we-media.cn/client/ai-guide API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products 公开产品目录：GET https://api.we-media.cn/api/v1/public/products 配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest uses a Chinese-only display name, "公众号找号", with no indication that the skill is intended only for Chinese-speaking users or that users can choose another language. This creates a natural-language locale policy concern because the skill appears to enforce a specific language without opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file’s primary natural-language instructions, status messages, and help output are written exclusively in Chinese, which imposes a specific language on users. There is no opt-in, fallback, or documentation indicating this skill is intentionally limited to a Chinese-speaking or region-specific audience.
- Content
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
python from workflow_core import atomic_json, digest, next_params, APIError, workspace_lock from platform_contract import identity_headers, catalog, price_micros, failure, product_path EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124 OFFICIAL = "https://api.we-media.cn" ROOT = "https://api.we-media.cn"
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The function returns user-visible placeholder strings in Chinese only (e.g. at L23 and L27). For a general-purpose utility file, this hard-codes a specific language without offering a locale choice or documenting that the skill is region-specific, which matches the language/locale policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This JSON config uses Chinese-only natural-language values such as endpoint names and purposes, which can impose a specific language on users or downstream tooling without opt-in. Because the file does not document that the skill is China-specific or offer any locale selection, it creates a potential language/locale policy issue.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The snapshot function creates directories and atomically replaces the target file on disk, which is a file-modifying operation. Although the function has an internal docstring about replacement behavior, there is no user-facing disclosure, prompt, or log in this code path to warn that an existing snapshot file may be overwritten.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code raises visible error messages in Chinese at L076 and L082. This imposes a specific language on users without any opt-in or indication that the skill is intended only for a Chinese-speaking or region-specific audience, which matches the language/locale policy concern.
- Content