wechat-search-topic-mining

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 6:17 AM UTC
• Version: 1.4.2

Overview

The skill is a disclosed WeChat topic-mining client that sends user-approved API requests to api.we-media.cn and saves local result files; the noted risks are expected for that purpose.

Before installing, understand that this skill uses a local WM_API_KEY or config key to call a paid third-party API, sends your search parameters to api.we-media.cn, and saves result files locally. Keep the API key out of chat and use the estimate and --pages controls to bound cost and collection scope.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared purpose is content/topic discovery and popularity analysis within the WeChat ecosystem. The actual code does not perform keyword search, index aggregation, article popularity analysis, recommendation expansion, or topic list generation. Instead, it implements a support utility for data safety: dropping sensitive keys such as cookies, authorization, tokens, and secrets; converting Decimal values; and redacting temporary or signed URLs, including special handling for mp.weixin.qq.com and channels.weixin.qq.com links. This is a materially different primary behavior from the declared user-facing purpose, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是一个内容选题挖掘工具，核心能力应包括基于关键词收集微信搜索/指数/文章/联想词数据，并输出选题方向与长尾拓展。但代码中没有任何搜索、抓取、关键词处理、文章汇总或选题生成逻辑。相反，它专门处理微信视频号互动数据的语义版本兼容、字段映射、精确值验证、展示和结构化分析。因此主用途与实际行为明显不符，属于实质性描述-行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是一个面向微信内容选题挖掘的分析能力，应当体现关键词搜索、相关文章/指数抓取、长尾词拓展和结果汇总。实际代码中没有任何与关键词挖掘、微信搜索、文章热度分析或选题生成直接相关的逻辑；相反，它主要围绕 API 平台的产品目录、价格计算、响应校验和快照管理展开。其核心外部访问目标是 https://api.we-media.cn 的产品/catalog 接口，而不是执行内容检索或分析。因此主目的与实际行为明显不一致，属于实质性描述—行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

该代码块是一个共享核心库（wm_core.py），主要负责认证、请求封装、产品目录/价格估算、网络重试、分页、缓存以及结果格式化输出。虽然它显然可被微信生态相关技能复用，但从这段代码本身看，并没有执行“围绕关键词做微信生态选题挖掘”的核心业务流程：没有接收关键词后查询微信搜索、微信指数、热门文章、联想词，也没有做汇总分析并产出“值不值得做/细分角度”的选题清单。因此，代码实际行为与声明的技能用途存在明显不匹配；声明描述的是上层具体业务技能，而提供的代码只是底层通用 SDK/运行时。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

声明描述的是一个面向内容运营的微信选题挖掘能力，应当看到搜索、指数、热门文章、联想词采集与汇总分析等业务逻辑。但给出的代码片段仅包含底层基础设施：计算摘要、读写 JSON 文件、文件锁防并发、分页参数计算、APIError 异常类，以及配置 API 域名。虽然这些可能作为某个更大系统的支撑模块存在，但就该片段本身而言，其实际行为与“围绕关键词做微信生态选题挖掘”的声明不一致，且展示了未在描述中体现的本地持久化和并发控制能力。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares operational behavior that uses environment variables, local file I/O, and outbound network access, but it does not define an explicit tool/permission scope. That creates an authorization ambiguity: a host may grant broader capabilities than users expect, increasing the chance of unintended data access or exfiltration through local files, environment secrets, or external API calls.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

先用小样本验证；未经我同意不自动扩大采集范围、不创建定时任务。

text

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 76% confidence

Finding

This line instructs use of an authenticated request with the same API key to query product information, which confirms transmission of credentials to an external service. Although this is part of intended functionality, the security concern is that the skill has no explicit permission boundary and encourages authenticated outbound requests from the agent environment; if the host or surrounding workflow is mis-scoped, secrets and request metadata could be exposed more broadly than users expect.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

文档入口：https://api.we-media.cn/client/ai-guide
API 市场与逐产品 AI 文档：https://api.we-media.cn/client/products
公开产品目录：GET https://api.we-media.cn/api/v1/public/products
配置 Key 后，预估使用同 Key 请求 GET https://api.we-media.cn/api/v1/products，考虑参数附加价与调用次数；不能把价格写死。
创建专属 Skill 不代表免除 API 调用费用，也不保证结果、收益或留存率。

## 请求身份与安全

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The exception message at L109 is user-facing natural language and is fixed in Chinese. This imposes a specific language on users without opt-in or any documented justification for a locale-specific restriction, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code presents its primary documentation and user-facing CLI guidance entirely in Chinese, and later runtime prompts are also Chinese-only. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/wm_core.py (reported line 33)May include surrounding context.

python

from workflow_core import atomic_json, digest, next_params, APIError, workspace_lock
from platform_contract import identity_headers, catalog, price_micros, failure, product_path

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module’s functionality appears to implement generic gateway/workflow infrastructure, request persistence, pricing-related helpers, and export mechanics rather than logic tied to WeChat topic mining as declared in the skill manifest. This kind of capability mismatch is dangerous because it can conceal undeclared data flows or operational behaviors, making review, permission scoping, and user trust assumptions inaccurate.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The docstring explicitly describes portable gateway workflows for live prices, durable requests, and evidence exports, which materially conflicts with a WeChat topic-mining skill. Such contradictions are a red flag in security review because they suggest code reuse from an unrelated system or intentional concealment of non-obvious capabilities, increasing the risk of hidden network or persistence behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest sets the skill display name entirely in Chinese ("微信选题挖掘") and provides no indication that language selection is optional or that the skill is intentionally region-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The function returns Chinese-language placeholder strings such as "[临时视频链接仅在采集内存中使用]" and "[临时资源地址未保存]" directly in code. This is a natural-language locale choice that is not presented as optional or configurable, which can violate language/locale policy expectations for general-purpose skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains natural-language documentation and CLI/user-facing output entirely in Chinese, including required guidance and runtime messages. Under the policy rule, forcing a specific language without user opt-in is a locale-policy violation when no alternative or opt-in mechanism is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The exception messages at L076 and L082 are hard-coded in Chinese, which imposes a specific language on users. The file does not indicate that this skill is region-specific or that users can opt into that locale, so this is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.