Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent for WeChat Mini Program development, but it includes unpinned cloud-tool commands around authentication and cloud operations that users should review before use.
Install only if you are comfortable with a skill that can guide agents through WeChat DevTools, CloudBase login, preview/upload, cloud-function deployment, and message-push configuration. Before running the documented `npx` commands, pin and verify package versions where possible, and use a non-production CloudBase environment for testing.
The documentation instructs users to run npx mcporter ... without pinning a specific package version, which can cause execution of whatever version is current at invocation time. In a security-sensitive agent skill, this increases supply-chain risk because future package updates or dependency compromise could lead to unintended code execution on the developer machine.
This command example uses npx mcporter without a pinned version, so the resolved package may change over time and may pull unreviewed code at execution time. Because the skill is aimed at developers performing cloud operations and authentication flows, successful exploitation could execute malicious code with access to local credentials or tokens.
Referencing npx mcporter without version constraints creates a time-of-use supply-chain exposure where later package changes alter what code is executed. In this context, the command is used to inspect server configuration and schemas, making it plausible for a compromised package to harvest environment information or developer tokens.
The example runs npx mcporter dynamically, which delegates trust to the latest package resolution instead of a reviewed version. For an agent skill that guides cloud administration workflows, this is materially risky because a compromised or typosquatted package could run arbitrary code during a trusted setup process.
This authentication command invokes npx mcporter without pinning, combining dynamic package execution with a credential-related workflow. That makes the risk more serious in context, since any malicious code executed at this step could intercept auth state, device-code flow details, or local session artifacts.
This example starts a device-code authentication flow via unpinned npx mcporter, which exposes users to arbitrary code execution precisely when credentials are being established. In this skill context, the command could be trusted and copied verbatim by developers, so a package compromise could lead to token theft or unauthorized cloud access.
The set_env example also relies on unpinned npx mcporter, creating a supply-chain risk where a future or malicious package version could alter environment targeting or exfiltrate configuration details. Because this is a cloud environment selection step, misuse could redirect operations to attacker-controlled or unintended environments.
This section instructs the agent to access console/network data and perform CloudBase operations, but it does not require an explicit user-facing notice about what data may be viewed, collected, or modified. In a development tool context, console logs, network traces, database records, and storage objects can contain tokens, personal data, or production content, so omitting a privacy and data-handling warning increases the risk of over-collection or unauthorized processing.
This markdown file contains natural-language guidance exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Line L169 states that message-push and customer-service auto-reply details are governed by the Chinese reference, making Chinese the controlling language for that part of the skill. This is a locale/language constraint presented as mandatory rather than optional or user-selected.
The file is entirely written in Chinese and presents the workflow as the 'current only supported path' without offering a language choice or documenting a justified locale restriction. Under the policy rule, forcing a specific language or locale in natural-language instructions can be a violation when no opt-in is provided.
No suspicious patterns detected.
