公众号文章数据透视

• Outcome: Review
• Latest audit: Sep 4, 2026 · 9:15 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its article-analytics purpose, but it bundles unnecessary bytecode and out-of-scope file-upload/API capabilities that users should review before installing.

Install only if you trust the publisher and are comfortable giving this skill a WeMedia API key, making paid API calls after confirmation, and storing results locally. Before approval, the publisher should remove shipped .pyc files, remove or isolate unrelated endpoints and upload helpers, and make any local-file upload behavior explicit and opt-in.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose is a narrow article analytics skill, but the content describes a broader generic API execution wrapper with estimation, billing flow, caching, pagination, export, and endpoint enumeration behavior not clearly reflected in the description. This mismatch can mislead operators about what the skill actually does, increasing the risk of approving broader capabilities, data handling, or chargeable actions than intended.

Ae1

High

• Category: analysis-evasion

Content

> 曼格云 skill ｜ 环节：看内容 ｜ 底层统一底座 `wm_core.py`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Skill ships a __pycache__ directory that normal discovery skips

High

• Category: Supply Chain

Content

Python may load .pyc from this directory even when decoy .py sources look clean (PEP 552 UNCHECKED_HASH).

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill is advertised as focused on single WeChat public-article data retrieval, but the endpoint catalog exposes a much broader API surface including account search, video-channel operations, hot search, miniprogram search, and AI media analysis. This violates least privilege and creates unnecessary capability expansion, increasing the risk of unauthorized data access, misuse, billing abuse, and policy circumvention if the agent can invoke endpoints outside its declared purpose.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The video-understanding and audio-transcription endpoints are outside the stated purpose of analyzing a single公众号文章 and materially broaden the skill into multimedia ingestion and AI processing. This increases the chance of unauthorized collection, transcription, and analysis of third-party media, as well as unnecessary cost exposure and prompt/data exfiltration through unrelated workflows.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill invokes Python scripts that require environment access, local file reads/writes, and outbound network calls, but the manifest does not declare any explicit tool scope or permissions boundary. This creates an execution-surface transparency problem: reviewers and users cannot tell what capabilities the skill needs, making over-privileged execution and unintended data access more likely.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The skill instructions, user-facing quoted text, and interaction guidance are all presented only in Chinese, and the file does not offer the user a language/locale choice or state that the skill is intentionally limited to Chinese-language operation. That creates a natural-language policy concern under the language/locale rule.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the operator to ask the user for an API key and then write it into a local config.json file, but this sensitive-secret handling is not clearly disclosed in the skill description. That can lead to users sharing credentials without informed consent and creates a local secret-at-rest risk if the file is left readable, committed, or reused by other processes.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: A temporary file-upload ticket is unrelated to reading a single public article and enables transfer of local user-provided files to external cloud storage. Even if marked internal, its presence expands the skill from passive retrieval into data egress, which could expose sensitive files or be chained into downstream AI processing beyond user expectations.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)

• Confidence: 92% confidence
• Finding: The script also auto-detects when videoUrl or audioUrl is actually a local filesystem path and silently uploads that file to remote storage. This implicit behavior is riskier than the explicit --file flag because a caller may believe they are passing a normal parameter string while the code interprets it as a local file and exfiltrates it off-host.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)

• Confidence: 92% confidence
• Finding: The script also auto-detects when videoUrl or audioUrl is actually a local filesystem path and silently uploads that file to remote storage. This implicit behavior is riskier than the explicit --file flag because a caller may believe they are passing a normal parameter string while the code interprets it as a local file and exfiltrates it off-host.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)

• Confidence: 92% confidence
• Finding: The script also auto-detects when videoUrl or audioUrl is actually a local filesystem path and silently uploads that file to remote storage. This implicit behavior is riskier than the explicit --file flag because a caller may believe they are passing a normal parameter string while the code interprets it as a local file and exfiltrates it off-host.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The module-level documentation and user-facing messages are written entirely in Chinese, including help, errors, and API key guidance, with no indication that users may select another language. Under the locale policy, forcing a specific language without opt-in is a natural-language policy issue unless the constraint is explicitly documented and justified as region-specific.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

import urllib.parse
import hashlib

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The manifest describes a skill for retrieving complete data about a single WeChat public article, including metrics, text/HTML, media lists, and reports. This core file additionally provides upload_file(), which reads arbitrary local files and uploads them to remote temporary storage for AI interfaces; that capability is not justified by the article-inspection purpose described in the manifest.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The upload_file() function reads a local file and transmits it to remote endpoints, first requesting an upload ticket and then POSTing the file contents to the returned upload URL. While the docstring describes the mechanics, the runtime behavior lacks a user-facing warning or confirmation that local file contents will be sent off-host, which is a safety-relevant operation for code files.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: This JSON manifest uses Chinese-language user-facing descriptions and notes, beginning with the exclusion reason at L014 and continuing throughout the endpoint metadata, but it does not indicate that Chinese is optional or that the skill is intentionally restricted to a Chinese-language audience. Under the language/locale policy rule, forcing a specific language without opt-in can be a policy concern.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The module docstring presents the skill name and usage instructions entirely in Chinese, and later user-facing messages are also Chinese-only. The policy requires flagging language or locale constraints when the skill forces a specific language without offering user choice or documenting a justified region-specific limitation.

Static analysis

No suspicious patterns detected.