ClawHub
Back to skill

Security audit

小程序变现助手

Security checks for vulnerabilities and agentic risk

Overview

This Chinese mini-program monetization guide is not deceptive, but its payment and membership examples contain serious security gaps that could mishandle paid access or revenue.

Install only if you treat this as a high-level monetization reference, not production-ready payment code. Before using its examples, require server-authoritative pricing, verified payment callbacks, order locking, amount and currency reconciliation, idempotent fulfillment, authenticated user identity, pinned dependencies, and a review by someone familiar with WeChat Pay security.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
references/wechat-pay-guide.md:220
Finding

Client-Controlled Payment Amount Enables Order Price Manipulation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
references/wechat-pay-guide.md:121
Finding

Payment Callback Marks Orders Paid Without Complete Transaction Reconciliation

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
references/membership-implementation.md:115
Finding

Membership Activation and Renewal Do Not Require Verified Payment

Content
View full analysis
existing.plan_duration) { await connection.query(` UPDATE memberships SET status = 'cancelled' WHERE id = ? `, [existing.id]) } } else { endTime.setDate(endTime.getDate() + plan.duration_days) } // 4. 创建会员记录 const [result] = await connection.query(` INSERT INTO memberships (user_id, plan_id, order_id, start_time, end_time) VALUES (?, ?, ?, ?, ?) `, [userId, planId, orderId, startTime, endTime]) // 5. 记录日志 await connection.query(` INSERT INTO subscription_logs (user_id, action, plan_id, amount) VALUES (?, 'subscribe', ?, ?) `, [userId, planId, plan.price]) await connection.commit() return { ...[truncated 2407 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/ad-monetization.md:254
Finding

Client-Controlled User Identifier Is Used for Advertisement Entitlement

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
references/wechat-pay-guide.md:45
Finding

Third-Party Payment Dependencies Are Installed Without Version Pinning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/ad-monetization.md (reported line 42)May include surrounding context.

代码实现：

xml
<!-- 页面底部Banner广告 -->
<ad unit-id="adunit-xxx" ad-type="banner" />

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/ad-monetization.md (reported line 42)May include surrounding context.

代码实现:

xml
<!-- 页面底部Banner广告 -->
<ad unit-id="adunit-xxx" ad-type="banner" />

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The natural-language content presents the skill in Chinese and does not indicate that the user can choose another language. Under the policy, forcing a specific language without user opt-in is a language/locale policy concern unless the restriction is clearly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill says to use it when users mention broad terms like "会员系统", "支付接入", and similar keywords, which can appear in many general product or development conversations beyond monetization-specific requests. It does not provide exclusion conditions or negative examples to clarify when those terms should not invoke this skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

text

**后端关键点：**
- 统一下单接口：`https://api.mch.weixin.qq.com/v3/pay/transactions/jsapi`
- 签名算法：HMAC-SHA256
- 回调通知：验签 + 更新订单状态

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/wechat-pay-guide.md (reported line 352)May include surrounding context.

text

**后端关键点：**
- 统一下单接口：`https://api.mch.weixin.qq.com/v3/pay/transactions/jsapi`
- 签名算法：HMAC-SHA256
- 回调通知：验签 + 更新订单状态

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

In this markdown file, the embedded frontend purchase flow creates an order, requests payment parameters, and triggers payment via multiple remote API calls, but the surrounding skill description provides no warning that user/order data will be sent to backend payment endpoints or that a paid action will be initiated. Under the markdown criteria for SQP-2, behaviors affecting user data and financial actions should be disclosed clearly in the description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file’s natural-language instructions, examples, and labels are all presented only in Chinese. Under the policy rule, forcing a specific language without user opt-in can be a locale/language policy violation when no alternative or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

该技能文档从标题开始即完全以中文编写，没有说明这是面向特定中文用户群体的区域性文档，也没有提供其他语言选项或用户可选的本地化说明。根据规则，强制单一语言而无用户选择，属于自然语言层面的语言/locale 政策风险。

Content

No source excerpt is available for this finding.