ClawHub
Back to skill

Security audit

微信选题挖掘

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches WeChat topic mining, but it needs Review because it can upload local files without a clear upload confirmation and can under-estimate paid multi-page API usage.

Review before installing. Use it only if you are comfortable storing a We-Media API key locally and sending queries to api.we-media.cn. Do not pass --file, videoUrl, or audioUrl values unless you intend to upload that local file, and be cautious with --pages because the displayed estimate may not reflect the full cost of multiple page requests.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared purpose is narrowly framed as WeChat topic mining, but the skill also exposes broader behaviors such as generic external API orchestration, local key storage, file generation, and report/export workflows not clearly disclosed in the description. This mismatch can mislead users and reviewers about the real attack surface, causing them to approve a skill without understanding its ability to persist secrets, produce local artifacts, or interact with broader infrastructure.

Ae1

High
Category
analysis-evasion
Content
> 曼格云 skill ｜ 环节：找方向 ｜ 底层统一底座 `wm_core.py`
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Skill ships a __pycache__ directory that normal discovery skips

High
Category
Supply Chain
Content
Python may load .pyc from this directory even when decoy .py sources look clean (PEP 552 UNCHECKED_HASH).
Confidence
95% confidence
Finding
Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High
Category
Supply Chain
Content
Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.
Confidence
95% confidence
Finding
Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High
Category
Supply Chain
Content
Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.
Confidence
95% confidence
Finding
Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill invokes local scripts, reads environment-derived secrets, writes `config.json`, performs network requests, and exports files, yet the manifest declares no `permissions` or `allowed-tools` scope. That creates an authority gap where reviewers and platforms cannot easily constrain or audit what the skill is allowed to access, increasing the chance of secret exposure, unintended file modification, or overbroad network use.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
This manifest-style JSON uses Chinese-only natural-language descriptions such as the compliance rationale in metadata, and the endpoint names/purposes throughout the file are likewise Chinese-only. For a general skill artifact, this imposes a specific language/locale without any documented opt-in or justification, which matches the language/locale policy violation criterion.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill is advertised as WeChat topic-mining, but the endpoint catalog exposes broader capabilities such as video/account resolution, media retrieval, download URLs, and multimodal AI analysis. This unnecessary capability expansion violates least privilege and increases the chance the skill can be repurposed for unrelated data collection or content extraction beyond the user's expected task.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script automatically uploads a user-supplied local file to a remote temporary storage service and converts it into a public URL, but it does not present a clear runtime warning or confirmation specifically at the upload point. In a CLI skill, this can cause unintended disclosure of local content if a user passes a path thinking it will be processed locally rather than transmitted off-host.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Content
_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)
Confidence
95% confidence
Finding
The script treats any non-URL parameter value for videoUrl/audioUrl that matches a local filesystem path as a file to upload automatically. This implicit behavior is riskier than the explicit --file path because a user may intend to pass a literal string or local reference and unknowingly trigger remote upload of a sensitive file.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Content
_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)
Confidence
95% confidence
Finding
The script treats any non-URL parameter value for videoUrl/audioUrl that matches a local filesystem path as a file to upload automatically. This implicit behavior is riskier than the explicit --file path because a user may intend to pass a literal string or local reference and unknowingly trigger remote upload of a sensitive file.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Content
_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)
Confidence
95% confidence
Finding
The script treats any non-URL parameter value for videoUrl/audioUrl that matches a local filesystem path as a file to upload automatically. This implicit behavior is riskier than the explicit --file path because a user may intend to pass a literal string or local reference and unknowingly trigger remote upload of a sensitive file.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
This Python file contains natural-language instructions and operational output entirely in Chinese, including key setup guidance and CLI help, with no indication that other languages are supported. Because SQP-3 applies to all file types, this is a language-policy issue when the skill does not provide user language choice or document a justified locale restriction.

Unbounded Resource Access

Medium
Category
Excessive Agency
Content
import urllib.parse
import hashlib

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"
Confidence
75% confidence
Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.