miniprogram-development

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:44 AM UTC
• Version: 1.28.57

Overview

The skill is coherent for WeChat Mini Program development, but users should review it because it documents unpinned remote package execution and sample logging that may retain customer message data.

Install only if you are comfortable reviewing and controlling the CloudBase tooling it invokes. Pin npm packages or verify versions before running the documented npx commands, avoid using -y for skill installs unless the source is already trusted, and redact message bodies, media references, tokens, and raw OpenIDs from production logs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: references/cloudbase-integration.md:36
• Finding: Execution of an Unpinned CloudBase MCP Package<![CDATA[ ## Vulnerability Details **File Location**: `references/cloudbase-integration.md`, lines 36–40 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "cloudbase": { "command": "npx", "args": ["@cloudbase/cloudbase-mcp@latest"], "description": "CloudBase MCP", "lifecycle": "keep-alive" } } } ``` ### Technical Analysis The configuration instructs `npx` to retrieve and execute the `latest` release of `@cloudbase/cloudbase-mcp`. The effective executable can therefore change after this Skill has been reviewed. This makes execution non-reproducible and prevents consumers from verifying that the package being run is the same package version assessed during the audit. Because the MCP process supports CloudBase authentication and cloud-resource operations, a compromised package release, npm account, or transitive dependency could execute code with the local user's privileges and access authentication state available to the MCP process. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or a transitive dependency. 2. A malicious release becomes the package version selected by the `latest` tag. 3. The agent starts the configured MCP server. 4. `npx` downloads and executes the malicious version without a locally pinned artifact. 5. The malicious process accesses files, process credentials, device-authentication state, or CloudBase operations available to the current user. 6. The attacker can steal credentials or manipulate accessible cloud resources. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the account running the agent. The accessible scope may include local files and CloudBase credentials or resources exposed to the MCP process. The resulting cloud impact is bounded by the authenticated user's CloudBase permissions but may include database, function, storage, ...[truncated 42 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace `@latest` with an exact, reviewed package version. - Commit a lockfile that records dependency versions and integrity hashes. - Prefer a preinstalled, verified package rather than allowing runtime downloads. - Require explicit user approval before installing or upgrading the MCP package. - Review release notes and package provenance before changing the pinned version. - Run the MCP process with only the filesystem and cloud permissions required for the requested operation. - Where supported, use npm provenance verification and an approved internal package registry or allowlist. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/wxide-vs-cloudbase-mcp.md:10
• Finding: Unpinned Skill Installer Execution with Confirmation Suppressed<![CDATA[ ## Vulnerability Details **File Location**: `references/wxide-vs-cloudbase-mcp.md`, line 10 **Vulnerability Type**: Unsafe remote dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add tencentcloudbase/cloudbase-skills -y ``` ### Technical Analysis The command executes the `skills` package through `npx` without pinning its version and installs content from a remotely maintained repository. The `-y` option suppresses interactive confirmation, reducing the opportunity to inspect the resolved installer version, source, and content before installation. Both the installer and the installed skill repository can change after the current project has been audited. If either source is compromised, malicious instructions or executable components could be introduced into the agent environment. ### Attack Path 1. An attacker compromises the unpinned `skills` npm package, its dependency chain, or the referenced remote skill repository. 2. The agent or user runs the documented command. 3. `npx` resolves and executes the current installer version. 4. The installer retrieves the current remote skill content. 5. The `-y` option causes installation to proceed without an interactive review step. 6. Malicious skill instructions or executable files become available to the agent and may affect subsequent privileged operations. ### Impact Assessment The immediate installer runs with the local user's privileges. A malicious installer could access or modify files available to that user. Malicious installed Skill content could also influence later agent behavior, potentially causing unauthorized tool calls or cloud-resource operations within the permissions granted to the agent. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the `skills` installer to an exact reviewed version. - Pin the remote repository to a reviewed commit SHA or immutable release. - Remove `-y` so the resolved source and planned changes can be reviewed. - Display the package version, repository URL, commit identifier, and installation destination before approval. - Inspect installed files before loading the Skill into an agent session. - Apply an allowlist for approved Skill publishers and repositories. - Run installation in a restricted environment without unnecessary credentials or cloud permissions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/message-push-customer-service.md:115
• Finding: Customer Message Content and Identifiers May Be Persisted in Cloud Logs<![CDATA[ ## Vulnerability Details **File Location**: `references/message-push-customer-service.md`, lines 115–127 **Vulnerability Type**: Excessive logging of sensitive customer data **Risk Level**: Medium ### Vulnerable Code ```js const cloud = require("wx-server-sdk"); cloud.init({ env: cloud.DYNAMIC_CURRENT_ENV }); exports.main = async (event, context) => { console.log("msg-push", event.MsgType, event.Event, event); return {}; }; ``` The accompanying checklist also recommends recording an OpenID when available. ### Technical Analysis The logging statement records the complete message-push `event`, rather than limiting logs to the minimum fields needed for troubleshooting. Depending on the callback type, the event may contain customer identifiers, message text, media references, and associated metadata. Cloud logs create a persistent secondary copy of this information with a potentially different access-control and retention model from the original customer-service system. Explicitly recording an OpenID can also make otherwise operational logs directly linkable to a specific WeChat user. This exceeds the minimum data needed for routine callback diagnostics. ### Attack Path 1. A customer sends sensitive text, media, or metadata through the Mini Program customer-service channel. 2. WeChat delivers the callback event to the configured cloud function. 3. The function writes the entire event, including available customer data, to CloudBase logs. 4. The logs retain the data according to the cloud logging configuration. 5. An operator, compromised administrator account, or other principal with log-reading permission accesses the retained customer content and identifiers. ### Impact Assessment The issue may disclose customer communications, stable user identifiers, media references, and message metadata to parties with cloud-log access. It also increases the impact of a compromised logging account and may create privacy, retention, and regulatory exp ...[truncated 185 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not log the complete callback event. - Log only non-sensitive operational fields, such as the callback type, event type, result code, and a generated correlation identifier. - Omit message bodies, media locations, tokens, and raw customer identifiers. - If correlation with a user is essential, use a keyed pseudonymous identifier rather than a raw OpenID. - Apply structured redaction before any callback data reaches the logger. - Restrict log-reading permissions according to least privilege. - Configure short, documented retention periods and prevent unnecessary log exports. - Disable verbose callback logging in production and document which fields are permitted in diagnostic logs. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (11)

Natural-Language Policy Violations

Medium

• Confidence: 85% confidence
• Finding: 文件标题及全文均以中文直接面向“coding agent”给出指令，但未说明这是仅适用于中文环境的区域性技能，也未提供语言选择或用户 opt-in。根据规则，强制特定语言而无选择或正当说明，属于自然语言层面的语言/locale 策略问题。

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: L005 的“操作面（强制）”与 L007 的“当前唯一支持路径”结合整篇仅中文表述，体现出对使用方式的强约束；同时文件未说明可按用户语言偏好提供其他语言版本或输出语言选择。根据该规则，若技能强制特定语言/locale 且无用户 opt-in，可构成自然语言政策问题。

Skill Enumeration

Medium

• Category: Agent Snooping

Content

**微信 IDE 暴露状态：** 规格设计了 `cloud_query_msg_push` / `cloud_manage_msg_push`（由 CloudBase MCP 的 `queryMessagePush` / `manageMessagePush` 经 `EXPOSED_TOOL_NAME` 映射；需微信侧升级 `@cloudbase/cloudbase-mcp` 后）—— **尚未暴露**。在此之前，本 skill 只把 **IDE UI + 现有 wxide CLI 云/预览命令** 当作面向 agent 的操作面。不要文档化或教授底层替代方案。

**维护者 E2E（不对产品 agent）：** CloudBase-MCP msg-push 工具的完整 ticket / 回归流程在外部 skill `wxide-qbase-msgpush-e2e`（`~/.workbuddy/skills/wxide-qbase-msgpush-e2e/SKILL.md`）。只指向该处；不要把其中的底层步骤复制进本参考。

## 何时阅读本参考

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The document recommends installing CloudBase Skills using `npx skills add tencentcloudbase/cloudbase-skills -y` without pinning an exact package version. This can lead to non-reproducible installs and creates a supply-chain risk if a newer or compromised package version is published, especially because users may execute the command directly from documentation.

Static analysis

No suspicious patterns detected.