wechat-official-history

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 6:17 AM UTC
• Version: 1.4.2

Overview

This skill is a disclosed WeChat public-account article lookup tool that uses a third-party API key and writes local result files, with no evidence of hidden persistence, destructive behavior, or unrelated data collection.

Install only if you are comfortable using the Mandarin WeChat/We-media workflow and sending queried public-account links or gh_ IDs to api.we-media.cn. Configure the API key locally, review the price estimate before using --yes, keep --pages scoped to the needed range, and direct outputs to a local path you control.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says this skill retrieves and lists WeChat public account articles/history. However, the provided code chunk does not implement any fetching, searching, parsing, or listing of公众号文章 at all. Instead, it is a generic safety utility that filters sensitive keys (such as cookies, tokens, secrets, headers) and redacts temporary or signed URLs. This is a materially different primary purpose from the declared user-facing capability, so the description does not accurately represent the actual behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about retrieving and browsing a public account’s article history and today’s posts. However, the supplied code is entirely focused on interaction-metric semantics for WeChat Channels/Finder data: it normalizes like/share/comment/recommend counts, remaps legacy gateway fields, validates exactness metadata, formats metric display values, and derives interaction profiles and ratios. There is no code for accepting article URLs or gh_ IDs, querying公众号文章 records, pagination of article history, keyword/history search, or selecting today's articles. The primary purpose is materially different, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about querying WeChat public account article history and today's posts. The supplied code does something materially different: it supports platform contract utilities such as product catalog lookup, pricing computation, API envelope validation, snapshot persistence, and cost estimation. Although the pricing logic contains a small WeChat-link-related adjustment for short links, that is only part of billing logic and does not implement article retrieval, pagination over account posts, keyword history search, or today's-post listing. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的是一个面向最终用户的具体业务技能：查询某个公众号的历史文章与今日发文。但提供的代码块只是微信生态 skill 的统一基础库，负责加载端点元数据、鉴权、调用远程 API、分页、缓存、计费与格式化输出。虽然其中有一处针对 wechat-native-account-articles 的分页特殊处理，说明它可能被相关技能复用，但该代码本身没有实现“给文章链接或 gh_ 原始ID 后查询公众号历史文章/今日发文”的核心业务行为。因此，代码实际行为与声明用途不一致，至少在该代码块层面无法支撑所宣称的具体功能。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared purpose is a user-facing公众号 article history/today query tool. The supplied code instead contains low-level utility functions for durable workflow execution and API pagination: digest generation, atomic JSON writes, JSON reads, custom APIError, directory lock handling, and next-page parameter calculation. While pagination support could be a supporting detail for the declared function, the rest of the visible behavior is generic infrastructure and introduces undeclared local file I/O and locking capabilities. Crucially, there is no visible code implementing the core promised behavior—accepting article links or gh_ IDs, querying account article history, filtering today's posts, or formatting article title/time/link results. Therefore the code chunk does not accurately represent the declared description.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill requests capabilities that imply environment access, filesystem read/write, and network use, but it does not declare any explicit tool scope or permission boundaries. This creates an over-privileged execution model where a host may allow broader actions than users expect, increasing the risk of unintended data access, local file modification, or outbound requests.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The skill is explicitly designed to send user-supplied query parameters and retrieved data to an external third-party API domain. Even though this is core functionality, it is still a real data egress boundary: article links, account identifiers, usage metadata, and API-authenticated requests leave the local environment and may expose sensitive research targets or user activity to the provider.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This line continues the external-service workflow and confirms reliance on a third-party API marketplace/documentation ecosystem. The security concern is not the presence of a URL itself, but that the skill operationalizes external requests tied to a local API key and potentially sensitive query inputs without a formalized egress control declaration.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。
创建专属 Skill 不代表免除 API 调用费用，也不保证结果、收益或留存率。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The public products endpoint represents outbound network access to a third-party domain. While not inherently malicious, it is security-relevant because it initiates external communication and could reveal environment usage patterns, client identity headers, and operator interest in specific services.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。
创建专属 Skill 不代表免除 API 调用费用，也不保证结果、收益或留存率。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The authenticated products request uses the same API key to query account/product data from the remote service, which introduces a stronger egress and privacy concern than a public endpoint. If misused or insufficiently disclosed, this could expose account metadata, billing-related information, or usage context to an external provider beyond the user's expectations.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。
创建专属 Skill 不代表免除 API 调用费用，也不保证结果、收益或留存率。

## 请求身份与安全

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill metadata says it is for querying a public account's historical and today's articles, but this endpoint also exposes account profile data such as name, bio, and original ID. That is a scope expansion beyond the declared capability, which can mislead users and downstream policy systems about what data the skill can access and return.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The short-link resolution endpoint is not described in the manifest, so the skill can process and transform arbitrary article URLs in a way users and reviewers may not expect. Hidden URL-resolution capability increases the chance of covert data collection, policy bypass, or unreviewed external fetch behavior, especially because URL-processing features are security-sensitive.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The raised error string is only in Chinese, which imposes a specific language on users without opt-in or documented locale constraints. This is a natural-language policy issue because the file otherwise does not indicate that the skill is China-region-specific or that Chinese-only output is intended.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file’s user-facing natural-language content, including the top-level module description, is entirely in Chinese and presents itself as a shared base for all WeChat ecosystem skills. Because this is a general-purpose core module rather than a clearly region-locked compliance tool, the file imposes a specific language without opt-in or alternative locale handling.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/wm_core.py (reported line 33)May include surrounding context.

python

from workflow_core import atomic_json, digest, next_params, APIError, workspace_lock
from platform_contract import identity_headers, catalog, price_micros, failure, product_path

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The key guidance text shown to users is fixed in Chinese, and similar hard-coded Chinese messages appear throughout the module for prompts, warnings, and errors. This creates a language policy issue because users are not given a locale choice and the constraint is not justified in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest uses a Chinese display name only, which may impose a specific language/locale on users without any visible opt-in or alternative. Under the policy rules, locale or language constraints should be optional or explicitly justified when they are enforced.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The function returns natural-language placeholder strings in Chinese ([临时视频链接仅在采集内存中使用] and [临时资源地址未保存]). Because the file does not indicate that the skill is region-specific or provide any user opt-in for locale, this is a language policy violation under the natural-language policy rule.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This code accesses sensitive environment variables (WM_API_KEY, MANGYUN_API_KEY, MANGE_API_KEY) to authenticate requests, but there is no explicit warning or user-facing notice at the point of access about credential use. The module docstring and CLI description mention pricing and no paid calls, but they do not disclose that credentials may be consumed from the environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code raises user-visible ValueError messages in Chinese at L076 and L082, but the file does not indicate any language choice, fallback, or region-specific justification. This creates a natural-language locale policy concern because users may be forced into a specific language without opt-in.

Content

No source excerpt is available for this finding.