公众号历史文章库

• Outcome: Review
• Latest audit: Sep 4, 2026 · 9:13 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches a WeChat article lookup tool, but it also ships under-disclosed local-file upload capability, broad unused API metadata, and Python bytecode that warrant review before installing.

Review before installing. Only use this if you are comfortable storing a WM_API_KEY locally and sending requests to api.we-media.cn. Do not pass --file or local videoUrl/audioUrl paths unless you intend to upload that file off-device. The publisher should remove shipped bytecode, narrow endpoints.json to the four advertised endpoints, and remove or explicitly gate local-file upload behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a narrow WeChat history lookup tool, but the documented behavior indicates broader generic API-client capabilities, export/report generation, caching, billing flows, and even temporary remote upload behavior beyond the stated purpose. This mismatch is dangerous because users and orchestrators may grant trust and permissions based on the narrow description while the skill performs materially broader actions, including data exfiltration and paid operations.

Ae1

High

• Category: analysis-evasion

Content

> 曼格云 skill ｜ 环节：追号 ｜ 底层统一底座 `wm_core.py`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Skill ships a __pycache__ directory that normal discovery skips

High

• Category: Supply Chain

Content

Python may load .pyc from this directory even when decoy .py sources look clean (PEP 552 UNCHECKED_HASH).

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High

• Category: Supply Chain

Content

Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.

• Confidence: 95% confidence
• Finding: Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The endpoint catalog exposes a much broader capability set than the skill's declared purpose of querying公众号历史文章与今日发文. This violates least privilege and creates unnecessary attack surface, enabling the skill to search accounts/articles broadly, fetch full article content and reports, interact with 视频号 resources, and invoke unrelated AI/media features if the agent is prompted or misused.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The 视频号 endpoints allow account/video lookup, ID resolution, share-link generation, playback URL retrieval, and live replay access, none of which are needed for a公众号文章库 skill. In this context, they substantially widen data access and action scope beyond user expectations, increasing abuse potential and making prompt-induced misuse more dangerous.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Video understanding and audio transcription endpoints are unrelated to the stated公众号历史文章查询 purpose and materially expand the skill into multimodal content processing. Their presence increases the chance of unauthorized analysis of user-supplied media or repurposing the skill for unintended surveillance, transcription, or content extraction workflows.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no explicit tool scope or permission boundaries even though its documented behavior requires environment access, local file read/write, and network access. This creates an over-privileged and under-specified execution model where an agent may invoke sensitive capabilities without clear policy constraints, increasing the chance of secret exposure, unintended filesystem modification, or unsafe outbound requests.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: A temporary file upload capability is unrelated to a read-only公众号文章查询 skill and enables data to be sent to external storage, producing a public URL consumable by other APIs. In this context, that creates an avoidable exfiltration path for local or user-provided files if the agent is induced to upload data.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The manifest says users can '按关键词翻历史' to search article history by keyword. In the script, the available endpoints are limited to article listing, today's articles, profile lookup, and article resolution, and while generic parameter names include 'keyword' and 'query', there is no explicit keyword-search endpoint or documented handling that implements the claimed behavior.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill is described as querying WeChat official account history, but it contains generic local file upload logic that can transmit arbitrary local files to remote cloud storage via wm.upload_file(). Because this behavior is unrelated to the advertised purpose, it expands the attack surface and can be abused to exfiltrate sensitive local data if an agent or user is induced to pass a local path.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)

• Confidence: 96% confidence
• Finding: The code automatically interprets parameter values such as videoUrl/audioUrl as local filesystem paths when they are not HTTP(S)/file URLs and uploads those files remotely. This implicit behavior can silently convert benign-looking arguments into exfiltration of local files, increasing the risk of accidental or induced leakage of sensitive data.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)

• Confidence: 96% confidence
• Finding: The code automatically interprets parameter values such as videoUrl/audioUrl as local filesystem paths when they are not HTTP(S)/file URLs and uploads those files remotely. This implicit behavior can silently convert benign-looking arguments into exfiltration of local files, increasing the risk of accidental or induced leakage of sensitive data.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)

• Confidence: 96% confidence
• Finding: The code automatically interprets parameter values such as videoUrl/audioUrl as local filesystem paths when they are not HTTP(S)/file URLs and uploads those files remotely. This implicit behavior can silently convert benign-looking arguments into exfiltration of local files, increasing the risk of accidental or induced leakage of sensitive data.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

import urllib.parse
import hashlib

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: 该技能清单描述的是查询公众号历史文章、今日发文和分页浏览，属于面向公众号文章数据的只读检索能力。但此文件额外实现了 upload_file()，可读取本地文件、申请上传票据并将文件上传到远程对象存储，属于与公众号历史文章查询无直接关系的独立能力。

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The upload_file() path performs two outbound network operations: it sends file metadata to the ticket endpoint and then uploads the local file contents to a remote uploadUrl. Although there are success/error logs, there is no explicit user-facing warning or confirmation that a local file will be transmitted off-host, which is safety-relevant for code handling user files and credentials.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: This JSON file contains natural-language descriptions only in Chinese, including the exclusion rationale at L014. Under the policy for natural-language content, forcing a specific language without opt-in or documented regional justification can be a locale-policy violation.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The endpoint metadata uses Chinese-only natural-language fields such as name, purpose, note, and reason throughout the manifest. Because the file does not state that the skill is region-specific or offer a language choice, this may violate the language/locale policy.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The natural-language instructions, warnings, and CLI guidance in this skill are presented in Chinese only, including operational and billing-related text. Under the stated policy, forcing a specific language without user opt-in can be a locale/language policy violation unless the constraint is explicitly documented and justified.

Static analysis

No suspicious patterns detected.