公众号竞品追踪

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 7:22 AM UTC
• Version: 1.4.3

Overview

This appears to be a disclosed WeChat public-account competitor analysis tool that uses a paid external API only after user approval and writes local reports.

Install only if you intend to use the WeMedia/MangYun API for Chinese WeChat public-account analysis. Expect the skill to read a local WM_API_KEY-compatible credential, send account/article request parameters to api.we-media.cn, incur costs after explicit approval and budget selection, and save evidence and report files locally. Review the broader competitor-analysis behavior if you expected only a single-account tracker.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (34)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Based on the supplied chunk, the code merely dispatches to main("competitors"). That suggests a different or broader primary purpose centered on competitor analysis, while the declaration specifically claims a公众号 account panorama tracking workflow with multiple concrete data collection steps and a performance report. Because the visible code does not evidence those declared behaviors and instead points to a differently named workflow, this is a likely description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

There is a material description/behavior mismatch. The declared purpose describes a panoramic tracking workflow for one official account: get account profile, get recent articles, get per-article interaction data, then summarize recent performance and hottest article. The supplied code is narrowly built for 'competitors' mode only, with repeated guards like '此 Skill 仅支持公众号对标'. Its plan schema requires accounts for comparison, supports up to 100 accounts, computes per-account comparative summaries, names the report '公众号同行对标', and includes account comparison sheets. It also performs undeclared deep reads by pulling article content text for top-ranked articles. While there is overlap in article history and metrics collection, the primary purpose and output are competitor benchmarking rather than single-account monitoring, and the declared initial account-profile retrieval is not actually implemented as a distinct workflow stage/output.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents an analytics/orchestration skill for tracking a WeChat public account's recent content and performance across multiple API calls. The supplied code does not implement any fetching, aggregation, analytics, or reporting logic. Instead, it is a utility for removing sensitive fields and sanitizing URLs for safe local evidence storage. This is not merely a supporting detail of the declared workflow because, in the provided chunk, the actual behavior is exclusively sanitization and does not substantiate the claimed end-user capability. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose describes an end-to-end公众号/official-account monitoring workflow involving multiple API calls and article-level reporting. The supplied code does not implement any fetching, account tracking, article listing, or cross-item summarization. Instead, it is a local utility module for metric normalization and interpretation of interaction counts specifically for WeChat Channels/Finder payloads, with explicit semantics around like/recommend/favorite mappings. This is a materially different primary purpose and resource scope from the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose is an end-user analytics workflow for WeChat public accounts and recent articles. The supplied code contains only infrastructure/contract utilities: building headers from client identity, listing products from /api/v1/products or /api/v1/public/products, computing per-call and total prices, checking response envelopes for failure, and maintaining scoped snapshots. While there is a minor WeChat-specific pricing adjustment for short links in price_micros, that is only used for billing estimation and does not perform the declared tracking or reporting workflow. The module’s main entrypoint explicitly estimates prices for a JSON request plan and makes no paid content/data calls. Therefore the actual primary purpose is platform pricing/contract support, not公众号全景追踪分析.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description promises a concrete multi-step analysis workflow focused on公众号 accounts: fetch account info, fetch recent article list, fetch interaction data for each article, and produce a summary of recent performance and hottest article. The actual code chunk does not contain that domain-specific orchestration. Instead, it is a reusable infrastructure module (wm_core.py) used by many skills, with endpoint lookup from endpoints.json, generic request execution, pagination, caching, pricing estimation, and output formatting. These are supporting/platform capabilities, but because the provided code chunk lacks the promised公众号-specific collection and summarization behavior, the description does not accurately represent what this code actually does. This is a material purpose mismatch, not just an implementation-detail difference.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The description promises a specific multi-step analytical workflow for WeChat public accounts. However, the provided code is infrastructure: it loads a product catalog, validates parameters, performs generic HTTP requests to api.we-media.cn, tracks request costs and budget limits, manages resumable job state, supports pagination, and exports reports/evidence. There is no code here that specifically selects the公众号-related endpoints, sequences 'account -> recent articles -> per-article interactions', or computes the stated summary of recent performance and top article. While this core could support such a skill, the supplied chunk by itself materially differs from the declared purpose and adds undeclared capabilities around billing/workspace/reporting.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares operational behaviors involving environment variables, local file I/O, and network access, but does not define an explicit tool/permission scope. That creates an overbroad trust boundary: a host may enable more capabilities than a user expects, increasing the chance of unintended data access or outbound requests. In this context the risk is amplified because the skill instructs use of API keys, checkpoint files, exports, and external API calls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The entire skill description and operating instructions are written only in Chinese, and there is no statement offering a language choice or asking the user to opt in to Chinese output. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a skill for monitoring one公众号's recent posts, interaction data, and overall recent performance. This file instead documents a '多账号对标工作流' that compares multiple accounts, analyzes topic differences and representative works, and produces comparative Excel reports, which is materially broader than the stated single-account tracker purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest presents the skill as a data-collection and summary capability for a公众号 account, but this documentation instructs running local Python scripts with budget controls, workspace management, and rendering Excel reports. Those operational capabilities go beyond the user-facing purpose as described and should be explicitly declared if they are part of the skill's intended behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This file contains hard-coded Chinese-only error and CLI help text, beginning at L023 and continuing throughout the script. Because the skill does not offer any language selection or indicate a justified locale restriction, it appears to force a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The raised ValueError message is hard-coded in Chinese, which imposes a specific language on users regardless of their locale or preference. There is no indication that the tool is intentionally region-specific or that users can opt into this language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring and user-facing usage instructions are entirely in Chinese, and additional runtime messages throughout the file also assume Chinese output. This imposes a specific language on users without offering a choice or documenting an explicit locale-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The top-level module docstring presents operational guidance entirely in Chinese, which imposes a specific language on users without any opt-in or alternative. This is a natural-language locale policy issue because the skill content does not offer language selection or justify a China-only audience in the file.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/wm_core.py (reported line 33)May include surrounding context.

python

from workflow_core import atomic_json, digest, next_params, APIError, workspace_lock
from platform_contract import identity_headers, catalog, price_micros, failure, product_path

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The KEY_GUIDE message shown to users is entirely in Chinese and contains required setup instructions, but it does not provide an alternative language or user choice. This forces a locale/language preference in user-facing guidance, which matches the policy category for natural-language violations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest says this skill is for tracking a public WeChat account’s profile, recent articles, interaction data, and generating a performance report. However, the module docstring describes 'live prices, durable requests and evidence exports', which frames the code as a generic paid API/workflow gateway rather than a purpose-built competitor-tracking workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The API class dynamically loads a product catalog, computes per-product pricing, injects idempotency keys, and executes arbitrary product slugs from that catalog. That is a reusable metered API client/platform-commerce capability, which is broader than the manifest’s stated purpose of collecting公众号资料、文章列表、互动数据并汇总报告 for a target account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The request method sends data to a remote API, including an X-API-Key header and serialized request parameters, but there is no confirmation prompt, logging, or nearby comment disclosing that user/system data will be transmitted. For code files, outbound network transmission is in scope when it lacks any form of user disclosure unless the behavior is clearly documented as the skill's stated purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest uses a Chinese-only display name string, which indicates a language-specific presentation choice. In this file there is no indication that the user can choose a locale or that the skill is intentionally limited to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.