公众号竞品追踪

• Outcome: Review
• Latest audit: Sep 4, 2026 · 9:27 AM UTC
• Version: 1.0.1

Overview

This WeChat tracking skill mostly matches its purpose, but it needs Review because it includes an undisclosed local-file upload path and can understate costs when pagination is used.

Install only if you are comfortable giving the skill a WeMedia API key and letting it write local reports/cache files. Do not use --file or provide local file paths, and be cautious with --pages because the displayed estimate may show one call while execution can make multiple paid calls. Remove shipped bytecode and add clearer secret-storage and upload restrictions before broad use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The description promises a composite tracking task that chains multiple APIs in one execution: account profile -> recent articles -> per-article interaction data -> consolidated analysis report. The supplied code does not contain any logic to perform that sequence. Instead, it exposes three endpoints and lets the caller invoke exactly one endpoint at a time by name. There is no orchestration between endpoints, no loop over returned articles to fetch metrics for each article, and no custom analysis identifying 'recent performance' or 'which article is hottest.' The formatting/report flags appear to be generic output presentation features from the shared framework, not the domain-specific synthesis described. Therefore the declared description materially overstates the implemented behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This code chunk does not match the declared skill purpose as written. The description promises a concrete multi-step公众号 analysis workflow: fetch account info, fetch recent articles, fetch engagement for each article, and produce a summary report about recent performance and hottest article. However, the provided code contains only a reusable platform core module used by many skills. It provides infrastructure features—auth, request execution, retries, pagination, caching, billing estimation, file upload, and formatting—but no公众号-specific endpoint sequence, no article-level aggregation logic, and no report logic tailored to 'recent performance' or 'which article is hottest.' Some support features like formatting/report generation could be consistent with the declared use case, but the primary behavior here is materially broader and different from the declared specialized skill behavior. Therefore this is a mismatch.

Ae1

High

• Category: analysis-evasion

Content

> 曼格云 skill ｜ 环节：看同行 ｜ 底层统一底座 `wm_core.py`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Skill ships a __pycache__ directory that normal discovery skips

High

• Category: Supply Chain

Content

Python may load .pyc from this directory even when decoy .py sources look clean (PEP 552 UNCHECKED_HASH).

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The endpoint inventory materially exceeds the stated skill purpose of tracking WeChat public-account competitors. It exposes unrelated capabilities including file upload, video-channel operations, article full-content retrieval, AI media analysis, and mini-program search, which increases attack surface and enables capability creep or misuse if the agent can call endpoints based on model discretion rather than strict allowlisting.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: `upload_file()` accepts an arbitrary local path, reads the file, obtains an upload ticket from the remote API, and uploads the file contents to a remote URL, effectively creating a local-file exfiltration primitive. In the context of a公众号 tracking/reporting skill, there is no justified need to access and transmit arbitrary local files, so this capability is especially dangerous if exposed through agent actions or prompt-controlled inputs.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill invokes a Python script that uses environment access, local file reads/writes, and network calls, but the manifest does not declare any tool scope or permissions boundaries. That makes the skill's effective capabilities broader and less auditable than the metadata suggests, increasing the risk of unintended secret access, local file modification, or external data transmission when the skill is run.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs storing the user's API key in a local config.json file without any warning about plaintext storage, file permissions, rotation, or avoiding accidental inclusion in logs/version control. Plaintext local secret storage increases the chance of credential leakage through filesystem access, backups, repo commits, or other local tooling, especially because this skill also writes files and performs networked operations.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This manifest-like JSON uses Chinese-only natural-language values for endpoint names, purposes, and notes throughout the file, with no indication that the skill is intentionally limited to Chinese-speaking users or a China-specific deployment. Under the policy, forcing a specific language without opt-in or documented justification is a natural-language policy violation.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
      "free": true,
      "internal": true,
      "note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
    },
    {
      "key": "account-balance",

• Confidence: 90% confidence
• Finding: The manifest includes a capability to upload arbitrary local files to temporary public cloud storage and return a public URL consumable by AI endpoints. In an agent setting, this can become a data exfiltration primitive if the model is induced to package and upload sensitive local or workspace files outside the narrow business purpose of public-account tracking.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
      "free": true,
      "internal": true,
      "note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
    },
    {
      "key": "account-balance",

• Confidence: 90% confidence
• Finding: The manifest includes a capability to upload arbitrary local files to temporary public cloud storage and return a public URL consumable by AI endpoints. In an agent setting, this can become a data exfiltration primitive if the model is induced to package and upload sensitive local or workspace files outside the narrow business purpose of public-account tracking.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

"purpose": "把本地文件传到平台临时存储，换回可直接喂给 AI 接口的公网地址",
      "free": true,
      "internal": true,
      "note": "非计费能力。两步：① 本接口取票据（uploadUrl/requiredFields/fileUrl，票据 2 小时有效）② multipart 直传到 uploadUrl（requiredFields 逐项 + file 字段）。单文件 ≤128MB，文件约 2 小时后自动清理。对象存储按文件内容识别 MIME，申请票据声明的 contentType 必须与其一致，否则 403；不一致时从 403 报错中取真实 MIME 纠正重试。由 wm_core.WM.upload_file() 封装，勿手工拼装。"
    },
    {
      "key": "account-balance",

• Confidence: 90% confidence
• Finding: The manifest includes a capability to upload arbitrary local files to temporary public cloud storage and return a public URL consumable by AI endpoints. In an agent setting, this can become a data exfiltration primitive if the model is induced to package and upload sensitive local or workspace files outside the narrow business purpose of public-account tracking.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

import urllib.parse
import hashlib

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The shared core exposes a generic `upload_file()` capability that can send arbitrary local files to a remote service, even though this skill’s declared purpose is public-account competitive tracking and reporting. That excess capability increases attack surface and enables data movement unrelated to the stated workflow, violating least-privilege expectations for this skill.

Static analysis

No suspicious patterns detected.