wechat-official-article-analytics

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 6:17 AM UTC
• Version: 1.4.2

Overview

This skill is a disclosed paid API helper for retrieving WeChat official-article data and saving local reports, with no evidence of hidden persistence or malicious behavior.

Install only if you intend to use the ManGeYun/We-Media API for WeChat article analytics. It will use a local API key if configured, make external API calls after confirmation, may incur per-call charges, and saves result files locally; review the requested endpoint, page count, output path, and estimated cost before running with --yes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says this skill returns complete data for a single公众号 article, including interaction metrics,正文 extraction, media lists, and full reports. The supplied code does none of that. It only defines a public_data function that recursively filters sensitive keys (such as cookies, authorization, tokens, secrets, headers), converts Decimal objects to strings, and sanitizes URLs by retaining only limited WeChat article identifiers or replacing temporary/signed links with placeholders. This is a materially different primary purpose: data redaction/safe serialization rather than article-data collection or reporting. Therefore the description does not accurately represent the provided code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是“单篇公众号文章完整数据获取”能力，重点包括文章内容提取与文章互动数据（阅读、点赞、分享、收藏）。但代码内容是一个互动指标规范化工具，专门针对微信视频号/Finder 网关返回的 metrics 做字段映射、精确值校验、占比/比值计算和展示辅助。代码中的文档字符串与常量都表明其作用域是 Finder/video/info response，而非公众号文章；同时代码还明确写明“本接口未提供独立收藏数”，与声明中支持收藏数据直接冲突。除此之外，代码完全没有正文抽取、HTML 提取、媒体清单整理、文章基本信息组装等逻辑。因此其实际主要用途与声明存在明显且实质性的不一致。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is a content/data retrieval skill for one specific公众号文章. However, this code chunk contains infrastructure for platform contracts and pricing: listing products from /api/v1/products or /api/v1/public/products, computing per-product prices based on parameters and short-link adjustments, validating API response envelopes, and storing comparison snapshots to disk. There is no logic to request a specific article, extract article正文/HTML/media, or return read/like/share/favorite metrics. This is a materially different primary purpose, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

声明描述的是一个面向最终用户的、用途明确的业务技能：获取某一篇公众号文章的完整数据。可提供的代码却是通用基础库 wm_core.py，主要负责鉴权、请求发送、费用预估、重试、分页、缓存和格式化输出。它依赖 endpoints.json 动态决定可调用哪些接口，因此实际能力范围远大于“单篇公众号文章数据”，且没有看到任何专门限定为单篇公众号文章、正文提取或互动指标汇总的业务实现。虽然这些通用能力可能是该技能的支撑组件，但就“ supplied code chunk 实际做什么”而言，其主要目的与声明的具体功能不一致，属于描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared purpose is narrowly about retrieving and returning complete data for a single public-account article. However, the code shown is infrastructure code for workflow orchestration and persistence: writing sanitized JSON to disk atomically, reading JSON files, locking a workspace to prevent concurrent runs, representing API errors, and computing next-page parameters for paginated APIs. These are not merely article-data extraction behaviors, and the snippet does not show the core promised functionality such as fetching article metadata, engagement stats,正文 extraction, HTML/media parsing, or selectable dimensions. While some support code could exist in a larger system, based on this supplied chunk the behavior is materially different and includes undeclared local file persistence/concurrency capabilities.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares executable behaviors involving environment variables, filesystem access, and network calls, but does not define any explicit tool scope or permission boundaries. That increases the risk of over-broad execution in a host agent, making it easier for the skill to access sensitive local data or perform unintended outbound requests beyond the user's expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description and all operating instructions are written entirely in Chinese, and there is no statement offering alternative languages or requiring Chinese due to a region-specific compliance constraint. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The raised ValueError contains only Chinese text, which imposes a specific language on users regardless of their locale. The file does not offer localization, opt-in language selection, or document that the skill is intentionally Chinese-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This file’s natural-language interface is entirely in Chinese, including the top-level module description and later CLI/error/help text, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless a justified region-specific constraint is documented.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/wm_core.py (reported line 33)May include surrounding context.

python

from workflow_core import atomic_json, digest, next_params, APIError, workspace_lock
from platform_contract import identity_headers, catalog, price_micros, failure, product_path

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes a skill focused on retrieving a single WeChat official article's analytics, content, media list, or a complete report. This file instead implements generic gateway/workflow helpers such as atomic local JSON persistence, workspace locking, request pagination state handling, and content hashing, without any article-specific extraction or analytics logic.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The top-level docstring says the module provides 'live prices, durable requests and evidence exports', which is inconsistent with a skill advertised as returning data for a single WeChat official account article. The code shown also contains no price-fetching or evidence-export implementation, so the documentation misstates both the intended domain and actual contents of the module.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The function returns user-visible placeholder messages in Chinese only: "[临时视频链接仅在采集内存中使用]" and "[临时资源地址未保存]". This forces a specific language/locale in output without any indication of user choice or documented regional scope, which matches the language-policy concern for natural-language content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script automatically checks several environment variables for API keys and uses the first one found when making catalog requests. Although the module docstring and CLI description mention pricing and no paid calls, there is no explicit user-facing warning that local credentials may be consumed from the environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code raises user-visible ValueError messages in Chinese only at L076 and L082. This imposes a specific language choice without any indication that the skill is region-specific or that users can opt into a locale, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.