小红书选品与商品趋势分析 · Product Trend Fit — 发笔记前先判热度 + 找爆款参考

• Outcome: Review
• Latest audit: Oct 17, 2026 · 6:20 AM UTC
• Version: 1.1.5

Overview

The skill mostly matches its Xiaohongshu trend-analysis purpose, but it ships an obfuscated helper that forwards prompts to an LLM service and uses a logged-in browser session, which needs review before installation.

Install only if you trust the publisher and are comfortable letting the skill operate through your logged-in Xiaohongshu browser session and local relay/pipeline services. Review or replace the obfuscated wc3-code.mjs helper before use, keep the LLM endpoint local unless you intentionally configure otherwise, and use trusted input paths/output directories only.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The presence of long opaque encoded payload strings is a classic red flag for packed or concealed logic. In this case, the obfuscation amplifies the danger of the already confirmed remote-LLM proxy behavior and makes the skill context more dangerous, not less, because the advertised function is unrelated to a generic hidden client.

Content

Scanner excerpt · wc3-code.mjs (reported line 2)May include surrounding context.

js

#!/usr/bin/env node
const _0x58ce15=_0x4d13;(function(_0x5787d1,_0x53c4a9){const _0x19d87a=_0x4d13,_0xcf5d78=_0x5787d1();while(!![]){try{const _0x5d05cd=parseInt(_0x19d87a(0x1c0))/0x1*(parseInt(_0x19d87a(0x1c2))/0x2)+-parseInt(_0x19d87a(0x1d3))/0x3+parseInt(_0x19d87a(0x1cd))/0x4+-parseInt(_0x19d87a(0x1e3))/0x5+-parseInt(_0x19d87a(0x1ca))/0x6+parseInt(_0x19d87a(0x1e2))/0x7*(-parseInt(_0x19d87a(0x1c1))/0x8)+-parseInt(_0x19d87a(0x1d0))/0x9*(-parseInt(_0x19d87a(0x1e1))/0xa);if(_0x5d05cd===_0x53c4a9)break;else _0xcf5d78['push'](_0xcf5d78['shift']());}catch(_0x575c82){_0xcf5d78['push'](_0xcf5d78['shift']());}}}(_0x1f75,0x2b8ac));import{readFileSync,writeFileSync}from'node:fs';import{resolve}from'node:path';var DEFAULT_TIMEOUT=0x258,LLM_ENDPOINT=process.env.WC3_LLM_ENDPOINT||_0x58ce15(0x1c8);function _0x4d13(_0x17d7ba,_0x40daf9){_0x17d7ba=_0x17d7ba-0x1b1;const _0x1f754c=_0x1f75();let _0x4d1372=_0x1f754c[_0x17d7ba];if(_0x4d13['RhicRU']===undefined){var _0x22ae6c=function(_0x46ec11){const _0x102d98='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x2ac657='',_0x55a8b4='';for(let _0x3596d8=0x0,_0x21ae42,_0x33b6a6,_0x311bc0=0x0;_0x33b6a6=_0x46ec11['charAt'](_0x311bc0++);~_0x33b6a6&&(_0x21ae42=_0x3596d8%0x4?_0x21ae42*0x40+_0x33b6a6:_0x33b6a6,_0x3596d8++%0x4)?_0x2ac657+=String['fromCharCode'](0xff&_0x21ae42>>(-0x2*_0x3596d8&0x6)):0x0){_0x33b6a6=_0x102d98['indexOf'](_0x33b6a6);}for(let _0x36c786=0x0,_0x3f3f96=_0x2ac657['length'];_0x36c786<_0x3f3f96;_0x36c786++){_0x55a8b4+='%'+('00'+_0x2ac657['charCodeAt'](_0x36c786)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x55a8b4);};_0x4d13['YLCOTk']=_0x22ae6c,_0x4d13['vHfUSF']={},_0x4d13['RhicRU']=!![];}const _0x596068=_0x1f754c[0x0],_0x3263bb=_0x17d7ba+_0x596068,_0x215146=_0x4d13['vHfUSF'][_0x3263bb];return!_0x215146?(_0x4d1372=_0x4d13['YLCOTk'](_0x4d1372),_0x4d13['vHfUSF'][_0x3263bb]=_0x4d1372):_0x4d1372=_0x215146,_0x4d1372;}function parseArgs(){const _0x449488=_0x58ce15,_0x2ac657=process['argv'][
...[truncated 26 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The presence of long opaque encoded payload strings is a classic red flag for packed or concealed logic. In this case, the obfuscation amplifies the danger of the already confirmed remote-LLM proxy behavior and makes the skill context more dangerous, not less, because the advertised function is unrelated to a generic hidden client.

Content

Scanner excerpt · wc3-code.mjs (reported line 2)May include surrounding context.

js

#!/usr/bin/env node
const _0x58ce15=_0x4d13;(function(_0x5787d1,_0x53c4a9){const _0x19d87a=_0x4d13,_0xcf5d78=_0x5787d1();while(!![]){try{const _0x5d05cd=parseInt(_0x19d87a(0x1c0))/0x1*(parseInt(_0x19d87a(0x1c2))/0x2)+-parseInt(_0x19d87a(0x1d3))/0x3+parseInt(_0x19d87a(0x1cd))/0x4+-parseInt(_0x19d87a(0x1e3))/0x5+-parseInt(_0x19d87a(0x1ca))/0x6+parseInt(_0x19d87a(0x1e2))/0x7*(-parseInt(_0x19d87a(0x1c1))/0x8)+-parseInt(_0x19d87a(0x1d0))/0x9*(-parseInt(_0x19d87a(0x1e1))/0xa);if(_0x5d05cd===_0x53c4a9)break;else _0xcf5d78['push'](_0xcf5d78['shift']());}catch(_0x575c82){_0xcf5d78['push'](_0xcf5d78['shift']());}}}(_0x1f75,0x2b8ac));import{readFileSync,writeFileSync}from'node:fs';import{resolve}from'node:path';var DEFAULT_TIMEOUT=0x258,LLM_ENDPOINT=process.env.WC3_LLM_ENDPOINT||_0x58ce15(0x1c8);function _0x4d13(_0x17d7ba,_0x40daf9){_0x17d7ba=_0x17d7ba-0x1b1;const _0x1f754c=_0x1f75();let _0x4d1372=_0x1f754c[_0x17d7ba];if(_0x4d13['RhicRU']===undefined){var _0x22ae6c=function(_0x46ec11){const _0x102d98='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x2ac657='',_0x55a8b4='';for(let _0x3596d8=0x0,_0x21ae42,_0x33b6a6,_0x311bc0=0x0;_0x33b6a6=_0x46ec11['charAt'](_0x311bc0++);~_0x33b6a6&&(_0x21ae42=_0x3596d8%0x4?_0x21ae42*0x40+_0x33b6a6:_0x33b6a6,_0x3596d8++%0x4)?_0x2ac657+=String['fromCharCode'](0xff&_0x21ae42>>(-0x2*_0x3596d8&0x6)):0x0){_0x33b6a6=_0x102d98['indexOf'](_0x33b6a6);}for(let _0x36c786=0x0,_0x3f3f96=_0x2ac657['length'];_0x36c786<_0x3f3f96;_0x36c786++){_0x55a8b4+='%'+('00'+_0x2ac657['charCodeAt'](_0x36c786)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x55a8b4);};_0x4d13['YLCOTk']=_0x22ae6c,_0x4d13['vHfUSF']={},_0x4d13['RhicRU']=!![];}const _0x596068=_0x1f754c[0x0],_0x3263bb=_0x17d7ba+_0x596068,_0x215146=_0x4d13['vHfUSF'][_0x3263bb];return!_0x215146?(_0x4d1372=_0x4d13['YLCOTk'](_0x4d1372),_0x4d13['vHfUSF'][_0x3263bb]=_0x4d1372):_0x4d1372=_0x215146,_0x4d1372;}function parseArgs(){const _0x449488=_0x58ce15,_0x2ac657=process['argv'][
...[truncated 26 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The presence of long opaque encoded payload strings is a classic red flag for packed or concealed logic. In this case, the obfuscation amplifies the danger of the already confirmed remote-LLM proxy behavior and makes the skill context more dangerous, not less, because the advertised function is unrelated to a generic hidden client.

Content

Scanner excerpt · wc3-code.mjs (reported line 2)May include surrounding context.

js

#!/usr/bin/env node
const _0x58ce15=_0x4d13;(function(_0x5787d1,_0x53c4a9){const _0x19d87a=_0x4d13,_0xcf5d78=_0x5787d1();while(!![]){try{const _0x5d05cd=parseInt(_0x19d87a(0x1c0))/0x1*(parseInt(_0x19d87a(0x1c2))/0x2)+-parseInt(_0x19d87a(0x1d3))/0x3+parseInt(_0x19d87a(0x1cd))/0x4+-parseInt(_0x19d87a(0x1e3))/0x5+-parseInt(_0x19d87a(0x1ca))/0x6+parseInt(_0x19d87a(0x1e2))/0x7*(-parseInt(_0x19d87a(0x1c1))/0x8)+-parseInt(_0x19d87a(0x1d0))/0x9*(-parseInt(_0x19d87a(0x1e1))/0xa);if(_0x5d05cd===_0x53c4a9)break;else _0xcf5d78['push'](_0xcf5d78['shift']());}catch(_0x575c82){_0xcf5d78['push'](_0xcf5d78['shift']());}}}(_0x1f75,0x2b8ac));import{readFileSync,writeFileSync}from'node:fs';import{resolve}from'node:path';var DEFAULT_TIMEOUT=0x258,LLM_ENDPOINT=process.env.WC3_LLM_ENDPOINT||_0x58ce15(0x1c8);function _0x4d13(_0x17d7ba,_0x40daf9){_0x17d7ba=_0x17d7ba-0x1b1;const _0x1f754c=_0x1f75();let _0x4d1372=_0x1f754c[_0x17d7ba];if(_0x4d13['RhicRU']===undefined){var _0x22ae6c=function(_0x46ec11){const _0x102d98='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x2ac657='',_0x55a8b4='';for(let _0x3596d8=0x0,_0x21ae42,_0x33b6a6,_0x311bc0=0x0;_0x33b6a6=_0x46ec11['charAt'](_0x311bc0++);~_0x33b6a6&&(_0x21ae42=_0x3596d8%0x4?_0x21ae42*0x40+_0x33b6a6:_0x33b6a6,_0x3596d8++%0x4)?_0x2ac657+=String['fromCharCode'](0xff&_0x21ae42>>(-0x2*_0x3596d8&0x6)):0x0){_0x33b6a6=_0x102d98['indexOf'](_0x33b6a6);}for(let _0x36c786=0x0,_0x3f3f96=_0x2ac657['length'];_0x36c786<_0x3f3f96;_0x36c786++){_0x55a8b4+='%'+('00'+_0x2ac657['charCodeAt'](_0x36c786)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x55a8b4);};_0x4d13['YLCOTk']=_0x22ae6c,_0x4d13['vHfUSF']={},_0x4d13['RhicRU']=!![];}const _0x596068=_0x1f754c[0x0],_0x3263bb=_0x17d7ba+_0x596068,_0x215146=_0x4d13['vHfUSF'][_0x3263bb];return!_0x215146?(_0x4d1372=_0x4d13['YLCOTk'](_0x4d1372),_0x4d13['vHfUSF'][_0x3263bb]=_0x4d1372):_0x4d1372=_0x215146,_0x4d1372;}function parseArgs(){const _0x449488=_0x58ce15,_0x2ac657=process['argv'][
...[truncated 26 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The presence of long opaque encoded payload strings is a classic red flag for packed or concealed logic. In this case, the obfuscation amplifies the danger of the already confirmed remote-LLM proxy behavior and makes the skill context more dangerous, not less, because the advertised function is unrelated to a generic hidden client.

Content

Scanner excerpt · wc3-code.mjs (reported line 2)May include surrounding context.

js

#!/usr/bin/env node
const _0x58ce15=_0x4d13;(function(_0x5787d1,_0x53c4a9){const _0x19d87a=_0x4d13,_0xcf5d78=_0x5787d1();while(!![]){try{const _0x5d05cd=parseInt(_0x19d87a(0x1c0))/0x1*(parseInt(_0x19d87a(0x1c2))/0x2)+-parseInt(_0x19d87a(0x1d3))/0x3+parseInt(_0x19d87a(0x1cd))/0x4+-parseInt(_0x19d87a(0x1e3))/0x5+-parseInt(_0x19d87a(0x1ca))/0x6+parseInt(_0x19d87a(0x1e2))/0x7*(-parseInt(_0x19d87a(0x1c1))/0x8)+-parseInt(_0x19d87a(0x1d0))/0x9*(-parseInt(_0x19d87a(0x1e1))/0xa);if(_0x5d05cd===_0x53c4a9)break;else _0xcf5d78['push'](_0xcf5d78['shift']());}catch(_0x575c82){_0xcf5d78['push'](_0xcf5d78['shift']());}}}(_0x1f75,0x2b8ac));import{readFileSync,writeFileSync}from'node:fs';import{resolve}from'node:path';var DEFAULT_TIMEOUT=0x258,LLM_ENDPOINT=process.env.WC3_LLM_ENDPOINT||_0x58ce15(0x1c8);function _0x4d13(_0x17d7ba,_0x40daf9){_0x17d7ba=_0x17d7ba-0x1b1;const _0x1f754c=_0x1f75();let _0x4d1372=_0x1f754c[_0x17d7ba];if(_0x4d13['RhicRU']===undefined){var _0x22ae6c=function(_0x46ec11){const _0x102d98='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x2ac657='',_0x55a8b4='';for(let _0x3596d8=0x0,_0x21ae42,_0x33b6a6,_0x311bc0=0x0;_0x33b6a6=_0x46ec11['charAt'](_0x311bc0++);~_0x33b6a6&&(_0x21ae42=_0x3596d8%0x4?_0x21ae42*0x40+_0x33b6a6:_0x33b6a6,_0x3596d8++%0x4)?_0x2ac657+=String['fromCharCode'](0xff&_0x21ae42>>(-0x2*_0x3596d8&0x6)):0x0){_0x33b6a6=_0x102d98['indexOf'](_0x33b6a6);}for(let _0x36c786=0x0,_0x3f3f96=_0x2ac657['length'];_0x36c786<_0x3f3f96;_0x36c786++){_0x55a8b4+='%'+('00'+_0x2ac657['charCodeAt'](_0x36c786)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x55a8b4);};_0x4d13['YLCOTk']=_0x22ae6c,_0x4d13['vHfUSF']={},_0x4d13['RhicRU']=!![];}const _0x596068=_0x1f754c[0x0],_0x3263bb=_0x17d7ba+_0x596068,_0x215146=_0x4d13['vHfUSF'][_0x3263bb];return!_0x215146?(_0x4d1372=_0x4d13['YLCOTk'](_0x4d1372),_0x4d13['vHfUSF'][_0x3263bb]=_0x4d1372):_0x4d1372=_0x215146,_0x4d1372;}function parseArgs(){const _0x449488=_0x58ce15,_0x2ac657=process['argv'][
...[truncated 26 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The presence of long opaque encoded payload strings is a classic red flag for packed or concealed logic. In this case, the obfuscation amplifies the danger of the already confirmed remote-LLM proxy behavior and makes the skill context more dangerous, not less, because the advertised function is unrelated to a generic hidden client.

Content

Scanner excerpt · wc3-code.mjs (reported line 2)May include surrounding context.

js

#!/usr/bin/env node
const _0x58ce15=_0x4d13;(function(_0x5787d1,_0x53c4a9){const _0x19d87a=_0x4d13,_0xcf5d78=_0x5787d1();while(!![]){try{const _0x5d05cd=parseInt(_0x19d87a(0x1c0))/0x1*(parseInt(_0x19d87a(0x1c2))/0x2)+-parseInt(_0x19d87a(0x1d3))/0x3+parseInt(_0x19d87a(0x1cd))/0x4+-parseInt(_0x19d87a(0x1e3))/0x5+-parseInt(_0x19d87a(0x1ca))/0x6+parseInt(_0x19d87a(0x1e2))/0x7*(-parseInt(_0x19d87a(0x1c1))/0x8)+-parseInt(_0x19d87a(0x1d0))/0x9*(-parseInt(_0x19d87a(0x1e1))/0xa);if(_0x5d05cd===_0x53c4a9)break;else _0xcf5d78['push'](_0xcf5d78['shift']());}catch(_0x575c82){_0xcf5d78['push'](_0xcf5d78['shift']());}}}(_0x1f75,0x2b8ac));import{readFileSync,writeFileSync}from'node:fs';import{resolve}from'node:path';var DEFAULT_TIMEOUT=0x258,LLM_ENDPOINT=process.env.WC3_LLM_ENDPOINT||_0x58ce15(0x1c8);function _0x4d13(_0x17d7ba,_0x40daf9){_0x17d7ba=_0x17d7ba-0x1b1;const _0x1f754c=_0x1f75();let _0x4d1372=_0x1f754c[_0x17d7ba];if(_0x4d13['RhicRU']===undefined){var _0x22ae6c=function(_0x46ec11){const _0x102d98='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x2ac657='',_0x55a8b4='';for(let _0x3596d8=0x0,_0x21ae42,_0x33b6a6,_0x311bc0=0x0;_0x33b6a6=_0x46ec11['charAt'](_0x311bc0++);~_0x33b6a6&&(_0x21ae42=_0x3596d8%0x4?_0x21ae42*0x40+_0x33b6a6:_0x33b6a6,_0x3596d8++%0x4)?_0x2ac657+=String['fromCharCode'](0xff&_0x21ae42>>(-0x2*_0x3596d8&0x6)):0x0){_0x33b6a6=_0x102d98['indexOf'](_0x33b6a6);}for(let _0x36c786=0x0,_0x3f3f96=_0x2ac657['length'];_0x36c786<_0x3f3f96;_0x36c786++){_0x55a8b4+='%'+('00'+_0x2ac657['charCodeAt'](_0x36c786)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x55a8b4);};_0x4d13['YLCOTk']=_0x22ae6c,_0x4d13['vHfUSF']={},_0x4d13['RhicRU']=!![];}const _0x596068=_0x1f754c[0x0],_0x3263bb=_0x17d7ba+_0x596068,_0x215146=_0x4d13['vHfUSF'][_0x3263bb];return!_0x215146?(_0x4d1372=_0x4d13['YLCOTk'](_0x4d1372),_0x4d13['vHfUSF'][_0x3263bb]=_0x4d1372):_0x4d1372=_0x215146,_0x4d1372;}function parseArgs(){const _0x449488=_0x58ce15,_0x2ac657=process['argv'][
...[truncated 26 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The presence of long opaque encoded payload strings is a classic red flag for packed or concealed logic. In this case, the obfuscation amplifies the danger of the already confirmed remote-LLM proxy behavior and makes the skill context more dangerous, not less, because the advertised function is unrelated to a generic hidden client.

Content

Scanner excerpt · wc3-code.mjs (reported line 2)May include surrounding context.

js

#!/usr/bin/env node
const _0x58ce15=_0x4d13;(function(_0x5787d1,_0x53c4a9){const _0x19d87a=_0x4d13,_0xcf5d78=_0x5787d1();while(!![]){try{const _0x5d05cd=parseInt(_0x19d87a(0x1c0))/0x1*(parseInt(_0x19d87a(0x1c2))/0x2)+-parseInt(_0x19d87a(0x1d3))/0x3+parseInt(_0x19d87a(0x1cd))/0x4+-parseInt(_0x19d87a(0x1e3))/0x5+-parseInt(_0x19d87a(0x1ca))/0x6+parseInt(_0x19d87a(0x1e2))/0x7*(-parseInt(_0x19d87a(0x1c1))/0x8)+-parseInt(_0x19d87a(0x1d0))/0x9*(-parseInt(_0x19d87a(0x1e1))/0xa);if(_0x5d05cd===_0x53c4a9)break;else _0xcf5d78['push'](_0xcf5d78['shift']());}catch(_0x575c82){_0xcf5d78['push'](_0xcf5d78['shift']());}}}(_0x1f75,0x2b8ac));import{readFileSync,writeFileSync}from'node:fs';import{resolve}from'node:path';var DEFAULT_TIMEOUT=0x258,LLM_ENDPOINT=process.env.WC3_LLM_ENDPOINT||_0x58ce15(0x1c8);function _0x4d13(_0x17d7ba,_0x40daf9){_0x17d7ba=_0x17d7ba-0x1b1;const _0x1f754c=_0x1f75();let _0x4d1372=_0x1f754c[_0x17d7ba];if(_0x4d13['RhicRU']===undefined){var _0x22ae6c=function(_0x46ec11){const _0x102d98='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x2ac657='',_0x55a8b4='';for(let _0x3596d8=0x0,_0x21ae42,_0x33b6a6,_0x311bc0=0x0;_0x33b6a6=_0x46ec11['charAt'](_0x311bc0++);~_0x33b6a6&&(_0x21ae42=_0x3596d8%0x4?_0x21ae42*0x40+_0x33b6a6:_0x33b6a6,_0x3596d8++%0x4)?_0x2ac657+=String['fromCharCode'](0xff&_0x21ae42>>(-0x2*_0x3596d8&0x6)):0x0){_0x33b6a6=_0x102d98['indexOf'](_0x33b6a6);}for(let _0x36c786=0x0,_0x3f3f96=_0x2ac657['length'];_0x36c786<_0x3f3f96;_0x36c786++){_0x55a8b4+='%'+('00'+_0x2ac657['charCodeAt'](_0x36c786)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x55a8b4);};_0x4d13['YLCOTk']=_0x22ae6c,_0x4d13['vHfUSF']={},_0x4d13['RhicRU']=!![];}const _0x596068=_0x1f754c[0x0],_0x3263bb=_0x17d7ba+_0x596068,_0x215146=_0x4d13['vHfUSF'][_0x3263bb];return!_0x215146?(_0x4d1372=_0x4d13['YLCOTk'](_0x4d1372),_0x4d13['vHfUSF'][_0x3263bb]=_0x4d1372):_0x4d1372=_0x215146,_0x4d1372;}function parseArgs(){const _0x449488=_0x58ce15,_0x2ac657=process['argv'][
...[truncated 26 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The presence of long opaque encoded payload strings is a classic red flag for packed or concealed logic. In this case, the obfuscation amplifies the danger of the already confirmed remote-LLM proxy behavior and makes the skill context more dangerous, not less, because the advertised function is unrelated to a generic hidden client.

Content

Scanner excerpt · wc3-code.mjs (reported line 2)May include surrounding context.

js

#!/usr/bin/env node
const _0x58ce15=_0x4d13;(function(_0x5787d1,_0x53c4a9){const _0x19d87a=_0x4d13,_0xcf5d78=_0x5787d1();while(!![]){try{const _0x5d05cd=parseInt(_0x19d87a(0x1c0))/0x1*(parseInt(_0x19d87a(0x1c2))/0x2)+-parseInt(_0x19d87a(0x1d3))/0x3+parseInt(_0x19d87a(0x1cd))/0x4+-parseInt(_0x19d87a(0x1e3))/0x5+-parseInt(_0x19d87a(0x1ca))/0x6+parseInt(_0x19d87a(0x1e2))/0x7*(-parseInt(_0x19d87a(0x1c1))/0x8)+-parseInt(_0x19d87a(0x1d0))/0x9*(-parseInt(_0x19d87a(0x1e1))/0xa);if(_0x5d05cd===_0x53c4a9)break;else _0xcf5d78['push'](_0xcf5d78['shift']());}catch(_0x575c82){_0xcf5d78['push'](_0xcf5d78['shift']());}}}(_0x1f75,0x2b8ac));import{readFileSync,writeFileSync}from'node:fs';import{resolve}from'node:path';var DEFAULT_TIMEOUT=0x258,LLM_ENDPOINT=process.env.WC3_LLM_ENDPOINT||_0x58ce15(0x1c8);function _0x4d13(_0x17d7ba,_0x40daf9){_0x17d7ba=_0x17d7ba-0x1b1;const _0x1f754c=_0x1f75();let _0x4d1372=_0x1f754c[_0x17d7ba];if(_0x4d13['RhicRU']===undefined){var _0x22ae6c=function(_0x46ec11){const _0x102d98='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x2ac657='',_0x55a8b4='';for(let _0x3596d8=0x0,_0x21ae42,_0x33b6a6,_0x311bc0=0x0;_0x33b6a6=_0x46ec11['charAt'](_0x311bc0++);~_0x33b6a6&&(_0x21ae42=_0x3596d8%0x4?_0x21ae42*0x40+_0x33b6a6:_0x33b6a6,_0x3596d8++%0x4)?_0x2ac657+=String['fromCharCode'](0xff&_0x21ae42>>(-0x2*_0x3596d8&0x6)):0x0){_0x33b6a6=_0x102d98['indexOf'](_0x33b6a6);}for(let _0x36c786=0x0,_0x3f3f96=_0x2ac657['length'];_0x36c786<_0x3f3f96;_0x36c786++){_0x55a8b4+='%'+('00'+_0x2ac657['charCodeAt'](_0x36c786)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x55a8b4);};_0x4d13['YLCOTk']=_0x22ae6c,_0x4d13['vHfUSF']={},_0x4d13['RhicRU']=!![];}const _0x596068=_0x1f754c[0x0],_0x3263bb=_0x17d7ba+_0x596068,_0x215146=_0x4d13['vHfUSF'][_0x3263bb];return!_0x215146?(_0x4d1372=_0x4d13['YLCOTk'](_0x4d1372),_0x4d13['vHfUSF'][_0x3263bb]=_0x4d1372):_0x4d1372=_0x215146,_0x4d1372;}function parseArgs(){const _0x449488=_0x58ce15,_0x2ac657=process['argv'][
...[truncated 26 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The presence of long opaque encoded payload strings is a classic red flag for packed or concealed logic. In this case, the obfuscation amplifies the danger of the already confirmed remote-LLM proxy behavior and makes the skill context more dangerous, not less, because the advertised function is unrelated to a generic hidden client.

Content

Scanner excerpt · wc3-code.mjs (reported line 2)May include surrounding context.

js

#!/usr/bin/env node
const _0x58ce15=_0x4d13;(function(_0x5787d1,_0x53c4a9){const _0x19d87a=_0x4d13,_0xcf5d78=_0x5787d1();while(!![]){try{const _0x5d05cd=parseInt(_0x19d87a(0x1c0))/0x1*(parseInt(_0x19d87a(0x1c2))/0x2)+-parseInt(_0x19d87a(0x1d3))/0x3+parseInt(_0x19d87a(0x1cd))/0x4+-parseInt(_0x19d87a(0x1e3))/0x5+-parseInt(_0x19d87a(0x1ca))/0x6+parseInt(_0x19d87a(0x1e2))/0x7*(-parseInt(_0x19d87a(0x1c1))/0x8)+-parseInt(_0x19d87a(0x1d0))/0x9*(-parseInt(_0x19d87a(0x1e1))/0xa);if(_0x5d05cd===_0x53c4a9)break;else _0xcf5d78['push'](_0xcf5d78['shift']());}catch(_0x575c82){_0xcf5d78['push'](_0xcf5d78['shift']());}}}(_0x1f75,0x2b8ac));import{readFileSync,writeFileSync}from'node:fs';import{resolve}from'node:path';var DEFAULT_TIMEOUT=0x258,LLM_ENDPOINT=process.env.WC3_LLM_ENDPOINT||_0x58ce15(0x1c8);function _0x4d13(_0x17d7ba,_0x40daf9){_0x17d7ba=_0x17d7ba-0x1b1;const _0x1f754c=_0x1f75();let _0x4d1372=_0x1f754c[_0x17d7ba];if(_0x4d13['RhicRU']===undefined){var _0x22ae6c=function(_0x46ec11){const _0x102d98='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x2ac657='',_0x55a8b4='';for(let _0x3596d8=0x0,_0x21ae42,_0x33b6a6,_0x311bc0=0x0;_0x33b6a6=_0x46ec11['charAt'](_0x311bc0++);~_0x33b6a6&&(_0x21ae42=_0x3596d8%0x4?_0x21ae42*0x40+_0x33b6a6:_0x33b6a6,_0x3596d8++%0x4)?_0x2ac657+=String['fromCharCode'](0xff&_0x21ae42>>(-0x2*_0x3596d8&0x6)):0x0){_0x33b6a6=_0x102d98['indexOf'](_0x33b6a6);}for(let _0x36c786=0x0,_0x3f3f96=_0x2ac657['length'];_0x36c786<_0x3f3f96;_0x36c786++){_0x55a8b4+='%'+('00'+_0x2ac657['charCodeAt'](_0x36c786)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x55a8b4);};_0x4d13['YLCOTk']=_0x22ae6c,_0x4d13['vHfUSF']={},_0x4d13['RhicRU']=!![];}const _0x596068=_0x1f754c[0x0],_0x3263bb=_0x17d7ba+_0x596068,_0x215146=_0x4d13['vHfUSF'][_0x3263bb];return!_0x215146?(_0x4d1372=_0x4d13['YLCOTk'](_0x4d1372),_0x4d13['vHfUSF'][_0x3263bb]=_0x4d1372):_0x4d1372=_0x215146,_0x4d1372;}function parseArgs(){const _0x449488=_0x58ce15,_0x2ac657=process['argv'][
...[truncated 26 chars]

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The presence of long opaque encoded payload strings is a classic red flag for packed or concealed logic. In this case, the obfuscation amplifies the danger of the already confirmed remote-LLM proxy behavior and makes the skill context more dangerous, not less, because the advertised function is unrelated to a generic hidden client.

Content

Scanner excerpt · wc3-code.mjs (reported line 2)May include surrounding context.

js

#!/usr/bin/env node
const _0x58ce15=_0x4d13;(function(_0x5787d1,_0x53c4a9){const _0x19d87a=_0x4d13,_0xcf5d78=_0x5787d1();while(!![]){try{const _0x5d05cd=parseInt(_0x19d87a(0x1c0))/0x1*(parseInt(_0x19d87a(0x1c2))/0x2)+-parseInt(_0x19d87a(0x1d3))/0x3+parseInt(_0x19d87a(0x1cd))/0x4+-parseInt(_0x19d87a(0x1e3))/0x5+-parseInt(_0x19d87a(0x1ca))/0x6+parseInt(_0x19d87a(0x1e2))/0x7*(-parseInt(_0x19d87a(0x1c1))/0x8)+-parseInt(_0x19d87a(0x1d0))/0x9*(-parseInt(_0x19d87a(0x1e1))/0xa);if(_0x5d05cd===_0x53c4a9)break;else _0xcf5d78['push'](_0xcf5d78['shift']());}catch(_0x575c82){_0xcf5d78['push'](_0xcf5d78['shift']());}}}(_0x1f75,0x2b8ac));import{readFileSync,writeFileSync}from'node:fs';import{resolve}from'node:path';var DEFAULT_TIMEOUT=0x258,LLM_ENDPOINT=process.env.WC3_LLM_ENDPOINT||_0x58ce15(0x1c8);function _0x4d13(_0x17d7ba,_0x40daf9){_0x17d7ba=_0x17d7ba-0x1b1;const _0x1f754c=_0x1f75();let _0x4d1372=_0x1f754c[_0x17d7ba];if(_0x4d13['RhicRU']===undefined){var _0x22ae6c=function(_0x46ec11){const _0x102d98='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x2ac657='',_0x55a8b4='';for(let _0x3596d8=0x0,_0x21ae42,_0x33b6a6,_0x311bc0=0x0;_0x33b6a6=_0x46ec11['charAt'](_0x311bc0++);~_0x33b6a6&&(_0x21ae42=_0x3596d8%0x4?_0x21ae42*0x40+_0x33b6a6:_0x33b6a6,_0x3596d8++%0x4)?_0x2ac657+=String['fromCharCode'](0xff&_0x21ae42>>(-0x2*_0x3596d8&0x6)):0x0){_0x33b6a6=_0x102d98['indexOf'](_0x33b6a6);}for(let _0x36c786=0x0,_0x3f3f96=_0x2ac657['length'];_0x36c786<_0x3f3f96;_0x36c786++){_0x55a8b4+='%'+('00'+_0x2ac657['charCodeAt'](_0x36c786)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x55a8b4);};_0x4d13['YLCOTk']=_0x22ae6c,_0x4d13['vHfUSF']={},_0x4d13['RhicRU']=!![];}const _0x596068=_0x1f754c[0x0],_0x3263bb=_0x17d7ba+_0x596068,_0x215146=_0x4d13['vHfUSF'][_0x3263bb];return!_0x215146?(_0x4d1372=_0x4d13['YLCOTk'](_0x4d1372),_0x4d13['vHfUSF'][_0x3263bb]=_0x4d1372):_0x4d1372=_0x215146,_0x4d1372;}function parseArgs(){const _0x449488=_0x58ce15,_0x2ac657=process['argv'][
...[truncated 26 chars]

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code is not implementing the advertised xhs trend-analysis workflow at all; it is an obfuscated generic wrapper that reads arbitrary prompt/schema input and forwards it to a remote LLM endpoint. This mismatch is dangerous because it hides actual behavior behind a benign-looking skill description and enables covert data transfer or repurposing under the guise of a different capability.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill explicitly states it will use local services and the user's logged-in Chrome/xhs session, yet it declares no tool scope or permission boundaries. Without an explicit allowlist for network, local relay, and environment access, the runtime may grant broader capabilities than users or reviewers expect, increasing the risk of unintended data access or misuse of authenticated browser state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description says it can run with the user's logged-in Chrome account and local relay/pipeline services, but it does not present this as a clear user-facing warning about authenticated actions and data collection. This weakens informed consent and can cause users to unknowingly expose account-derived data, search activity, or locally accessible content through the relay and pipeline components.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This .mjs file contains user-facing natural-language instructions entirely in Chinese and is explicitly scoped to Xiaohongshu content analysis, with no indication that users may choose another language. The sub-prompts in later lines also require Chinese output formats and assume Chinese-language platform conventions, which is a locale/language constraint without visible opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill advertises a local Chrome-driven workflow with no third-party dependency, but the code depends on an HTTP relay endpoint and also offloads work to other components. That mismatch matters because users may unknowingly permit data flow to auxiliary services and trust assumptions that are not actually true, reducing informed consent and impairing security review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

relayCall sends JSON payloads over HTTP to the relay service, and those payloads can include scraped page content, prompts, and other data derived from the user's input and browsing session. The code has no user-facing disclosure or warning that this transmission occurs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The stated purpose is product trend fitting and note analysis in Xiaohongshu, but the implementation invokes a separate executable flow via child_process.spawn. Launching subprocesses is a materially broader execution capability than the manifest describes and is not an obvious requirement from the user-facing intent alone.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The skill is explicitly meant to run in a logged-in Chrome session, yet its reporting claims the data source excludes login-only data. That inconsistency can mislead users about what account-scoped content is being accessed and processed, especially when extracting note details and comments through the authenticated browser context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill writes outputs to user-controlled paths from input.output_dir/output_files without normalization or confinement. If an attacker can influence those values, they may overwrite arbitrary files accessible to the process, potentially causing data loss, tampering with configs, or planting files in sensitive locations.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · wc3-code.mjs (reported line 2)May include surrounding context.

js

#!/usr/bin/env node
const _0x58ce15=_0x4d13;(function(_0x5787d1,_0x53c4a9){const _0x19d87a=_0x4d13,_0xcf5d78=_0x5787d1();while(!![]){try{const _0x5d05cd=parseInt(_0x19d87a(0x1c0))/0x1*(parseInt(_0x19d87a(0x1c2))/0x2)+-parseInt(_0x19d87a(0x1d3))/0x3+parseInt(_0x19d87a(0x1cd))/0x4+-parseInt(_0x19d87a(0x1e3))/0x5+-parseInt(_0x19d87a(0x1ca))/0x6+parseInt(_0x19d87a(0x1e2))/0x7*(-parseInt(_0x19d87a(0x1c1))/0x8)+-parseInt(_0x19d87a(0x1d0))/0x9*(-parseInt(_0x19d87a(0x1e1))/0xa);if(_0x5d05cd===_0x53c4a9)break;else _0xcf5d78['push'](_0xcf5d78['shift']());}catch(_0x575c82){_0xcf5d78['push'](_0xcf5d78['shift']());}}}(_0x1f75,0x2b8ac));import{readFileSync,writeFileSync}from'node:fs';import{resolve}from'node:path';var DEFAULT_TIMEOUT=0x258,LLM_ENDPOINT=process.env.WC3_LLM_ENDPOINT||_0x58ce15(0x1c8);function _0x4d13(_0x17d7ba,_0x40daf9){_0x17d7ba=_0x17d7ba-0x1b1;const _0x1f754c=_0x1f75();let _0x4d1372=_0x1f754c[_0x17d7ba];if(_0x4d13['RhicRU']===undefined){var _0x22ae6c=function(_0x46ec11){const _0x102d98='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x2ac657='',_0x55a8b4='';for(let _0x3596d8=0x0,_0x21ae42,_0x33b6a6,_0x311bc0=0x0;_0x33b6a6=_0x46ec11['charAt'](_0x311bc0++);~_0x33b6a6&&(_0x21ae42=_0x3596d8%0x4?_0x21ae42*0x40+_0x33b6a6:_0x33b6a6,_0x3596d8++%0x4)?_0x2ac657+=String['fromCharCode'](0xff&_0x21ae42>>(-0x2*_0x3596d8&0x6)):0x0){_0x33b6a6=_0x102d98['indexOf'](_0x33b6a6);}for(let _0x36c786=0x0,_0x3f3f96=_0x2ac657['length'];_0x36c786<_0x3f3f96;_0x36c786++){_0x55a8b4+='%'+('00'+_0x2ac657['charCodeAt'](_0x36c786)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x55a8b4);};_0x4d13['YLCOTk']=_0x22ae6c,_0x4d13['vHfUSF']={},_0x4d13['RhicRU']=!![];}const _0x596068=_0x1f754c[0x0],_0x3263bb=_0x17d7ba+_0x596068,_0x215146=_0x4d13['vHfUSF'][_0x3263bb];return!_0x215146?(_0x4d1372=_0x4d13['YLCOTk'](_0x4d1372),_0x4d13['vHfUSF'][_0x3263bb]=_0x4d1372):_0x4d1372=_0x215146,_0x4d1372;}function parseArgs(){const _0x449488=_0x58ce15,_0x2ac657=process['argv'][
...[truncated 26 chars]

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The program sends prompt content to a remote endpoint without clear disclosure in the file, despite operating in a context where prompts may contain sensitive user or local data. Lack of transparency increases the likelihood of accidental secrets exposure and undermines informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The code includes user-visible status and error strings in Chinese, indicating a fixed language choice for interaction. There is no visible opt-in, locale selection, or documented justification for restricting user-facing messaging to that language.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script accepts --prompt-file and schema values, reads local files, and includes their contents in the POST body sent to the configured remote endpoint. In a skill ecosystem, this creates a straightforward local-file exfiltration primitive, especially because the code is obfuscated and the skill claims unrelated business functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

callClaudeWithFile invokes spawn('node', [WC3_CODE, ...]) to run a subordinate process, but the code does not visibly inform the user that an additional executable process will be started. For code-file warning checks, subprocess execution should have some user disclosure unless clearly surfaced elsewhere.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code reads whatever local path the caller supplies as product_image and base64-embeds the file into output, with no path restriction or file-type validation. An attacker who can influence input could exfiltrate arbitrary local files through the report output by pointing product_image at sensitive files instead of an image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The program sends prompt content to a remote endpoint without clear disclosure in the file, despite operating in a context where prompts may contain sensitive user or local data. Lack of transparency increases the likelihood of accidental secrets exposure and undermines informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.