ClawHub
Back to skill

Security audit

微信小程序开发辅助

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only WeChat Mini Program helper with some risky example snippets, but it does not install code, persist, or perform hidden actions.

Install only if you want Chinese-language WeChat Mini Program reference snippets. Treat the examples as starting points, not production-ready code: do not log user profile data, request profile or location access only with clear user consent and privacy disclosure, replace placeholder API endpoints, and verify payment signing parameters against current official WeChat Pay requirements.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:104
Finding

Personal Information Exposed Through Debug Logging

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 104-109
Vulnerability Type: Sensitive information exposure through application logs
Risk Level: Medium

Vulnerable Code

javascript
wx.getUserProfile({
  success: res => {
    console.log(res.userInfo);
  }
});

Technical Analysis

The example writes the complete userInfo object returned by wx.getUserProfile to the console. Depending on the platform and application configuration, console output may be accessible through development tools, remote debugging sessions, captured device logs, screenshots, or centralized logging services.

Because this is presented as a reusable development template, developers may copy it into production code without removing the diagnostic statement. The exposure does not occur merely by loading the Skill; it requires the example to be incorporated into an application and executed after the user authorizes profile access.

Attack Path

  1. A developer copies the profile authorization example into a Mini Program.
  2. The application requests and receives authorized user profile information.
  3. The callback writes the returned profile object to application logs.
  4. Logs are retained by debugging, monitoring, or log aggregation infrastructure.
  5. A person with unauthorized or excessive access to those logs retrieves the exposed profile information.

Impact Assessment

An attacker cannot directly gain system privileges through this issue. The affected scope is limited to profile data processed by application instances containing the copied example. Potential impact includes unauthorized disclosure of personal information, privacy violations, and increased exposure through third-party logging infrastructure.

Remediation
View remediation

Remediation Suggestions

  • Remove logging of the complete userInfo object.
  • If diagnostics are necessary, log only non-sensitive status information, such as whether authorization succeeded.
  • Redact or tokenize any identifiers before they enter logs.
  • Disable verbose logging in production builds.
  • Configure retention periods and access controls for development and centralized logs.
  • Add an explicit warning to the template that authorized profile data must not be written to logs.

A safer example is:

javascript
wx.getUserProfile({
  success: () => {
    console.log('User profile authorization succeeded');
  },
  fail: () => {
    console.log('User profile authorization failed');
  }
});

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:113
Finding

Legacy MD5 Signing Recommended in Payment Template

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 113-122
Vulnerability Type: Weak cryptographic configuration in a payment example
Risk Level: Medium

Vulnerable Code

javascript
wx.requestPayment({
  timeStamp: '',
  nonceStr: '',
  package: '',
  signType: 'MD5',
  paySign: '',
  success: () => {},
  fail: () => {}
});

Technical Analysis

The payment template explicitly configures signType as MD5. MD5 is a legacy cryptographic primitive with known collision weaknesses and should not be recommended as a general-purpose signing choice for new security-sensitive integrations.

The template may encourage developers to retain obsolete payment configuration without checking the strongest algorithm supported by the applicable WeChat Pay API version. The code does not contain signing keys or perform signature generation itself, so loading the Skill does not directly compromise transactions. Exploitation would require the template to be adopted in an actual payment implementation and weaknesses elsewhere in the signing protocol or key handling to make the legacy configuration practically useful to an attacker.

Attack Path

  1. A developer copies the payment example into a Mini Program.
  2. The payment integration is deployed with signType: 'MD5' instead of a stronger supported algorithm.
  3. Payment parameters and signatures are generated using the corresponding legacy server-side configuration.
  4. An attacker targets weaknesses in the surrounding payment implementation, such as weak secret management, canonicalization errors, replay handling, or inadequate server-side verification.
  5. The legacy cryptographic configuration reduces defense in depth and may increase the feasibility or impact of transaction-integrity attacks.

Impact Assessment

The snippet alone does not provide an attacker with payment credentials, signing keys, application privileges, or a demonstrated method for forging a valid transaction. In a deploy ...[truncated 309 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace MD5 with the strongest signing algorithm supported and recommended by the current payment API and merchant configuration.
  • Confirm algorithm requirements against current official WeChat Pay documentation rather than relying on a generic static template.
  • Generate payment signatures exclusively on a trusted backend; never expose merchant secrets or private keys to Mini Program client code.
  • Validate payment amount, order identifier, merchant identity, expiration, and transaction state on the server.
  • Use cryptographically secure nonces and enforce timestamp and replay protections.
  • Verify payment completion through authenticated server-side notifications rather than relying solely on the client success callback.
  • Update the template to state that signing algorithms and parameters are API-version-specific.

Where supported by the relevant API, use a stronger configured algorithm, for example:

javascript
wx.requestPayment({
  timeStamp: '',
  nonceStr: '',
  package: '',
  signType: 'RSA',
  paySign: '',
  success: () => {},
  fail: () => {}
});

The exact value must match the algorithm used by the trusted backend and supported by the applicable payment API.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
this.setData({ loading: true });
    return new Promise((resolve, reject) => {
      wx.request({
        url: 'https://api.example.com/data',
        success: res => {
          this.setData({ 
            list: res.data,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file contains sample code for wx.getUserProfile and later discusses declaring scope.userLocation permissions, both of which involve personal data or sensitive permissions. The surrounding documentation does not warn users about privacy impact, consent expectations, or the need to explain why such data is collected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file's description, headings, and interaction text are written exclusively in Chinese, including the closing prompt to the user. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.