Security audit

微信小程序自动化测试

Security checks for vulnerabilities and agentic risk

Overview

This is a real WeChat Mini Program testing skill, but its local automation code has unsafe execution and data-handling issues that should be reviewed before installing.

Install only in a controlled development environment with test data. Review and restrict the WebSocket endpoint to localhost, avoid untrusted endpoint values, pin the npm dependency locally, and treat screenshots, exported reports, WXML/page data, form inputs, and system information as sensitive before sharing or storing outputs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/weapp_automation.py:126
Finding: JavaScript Injection Through an Unescaped WebSocket Endpoint
Content: View full analysis
str: ws_endpoint = self.config.ws_endpoint if hasattr(self.config, 'ws_endpoint') else 'ws://localhost:9420' base_script = ''' const automator = require('miniprogram-automator'); async function runTest() { const miniProgram = await automator.connect({ wsEndpoint: '%%WS_ENDPOINT%%' }); const results = []; try { let page = await miniProgram.currentPage(); // Generated automation operations are inserted here. %s await miniProgram.disconnect(); console.log('BATCH_RESULT: ' + safeStringify(results)); } catch (error) { results.push({ success: false, error: error.message }); console.log('BATCH_RESULT: ' + safeStringify(results)); await miniProgram.disconnect(); process.exit(1); } } runTest(); ''' # Action snippets are generated above this return statement. return base_script.replace('%%WS_ENDPOINT%%', ws_endpoint) % "".join(js_code) ``` The generated script is subsequently executed at `scripts/weapp_automation.py:104-112`: ```python result = subprocess.run( ["node", script_path], capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=self.config.timeout * len(steps), env=env, ) ``` `scripts/console_reader.py:94-106`: ```python ws_endpoint = self.ws_endpoint script_content = f''' const automator = require('miniprogram-automator'); async function getLogs() {{ try {{ const miniProgram = await automator.connect({{ wsEndpoint: '{ws_endpoint}' }}); ``` `scripts/console_read ...[truncated 2314 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/weapp_automation.py:85
Finding: Predictable Temporary JavaScript Files Permit Symlink and Replacement Attacks
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:50
Finding: Unpinned npm Dependency Creates a Supply-Chain Execution Risk
Content: View full analysis
Remediation: View remediation
``` 2. Prefer a project-local dependency instead of a global installation. 3. Commit a lockfile containing resolved versions and integrity hashes, and use reproducible installation: ```bash npm ci ``` 4. Document the expected official package name, publisher, registry, and reviewed version to reduce dependency-confusion and registry-mirror risks. 5. Review the dependency's transitive dependency tree and npm lifecycle scripts before approving version updates. 6. Use automated dependency scanning and require security review for lockfile changes. 7. Where operationally feasible, install with lifecycle scripts disabled and enable only explicitly reviewed scripts: ```bash npm ci --ignore-scripts ``` 8. Run the Node.js automation process under a least-privileged account with access limited to the intended Mini Program project and screenshot/report directories. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description presents a full-featured mini program automation testing toolkit, but this code chunk is much narrower. It mainly reads data from an existing DevTools connection, parses/filter/exports logs, and collects performance/system information. It does not show functionality for launching DevTools, driving page navigation, interacting with UI elements, taking screenshots, or visual comparison. Additionally, it includes performance monitoring, which is not mentioned in the declared purpose. While console log reading is declared and partially aligned, the implemented retrieval is limited and even appears to fetch page/system info rather than true console/error/network logs. Overall, the code's actual behavior does not accurately match the breadth and focus of the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The supplied code is narrowly focused on launching and controlling WeChat DevTools via its CLI and opening an automation test port. While this partially aligns with the 'launching DevTools' part of the description, it does not implement most of the described toolkit capabilities such as page navigation, element interaction, screenshots, screenshot comparison, or console log access. Therefore, the declared description materially overstates the actual functionality present in this code chunk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documentation says the tool reads console output and network requests, but the implementation actually collects page routes and system information. In a testing skill, that mismatch is security-relevant because users may authorize or run the tool under false assumptions, causing unintended collection and exposure of environmental/device metadata.
Content: No source excerpt is available for this finding.

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · scripts/weapp_automation.py (reported line 91)May include surrounding context.
python
try: # Ensure NODE_PATH includes global npm modules so temp scripts can find them env = os.environ.copy() if "NODE_PATH" not in env: try: npm_global = subprocess.run(

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Using shell=True to invoke npm is an avoidable unsafe pattern in a tool that executes local automation. In hostile or multi-user environments, PATH or shell-related manipulation could cause an attacker-controlled executable to run, making the skill context moderately more dangerous because the module already launches local helper tools automatically.
Content: Scanner excerpt · scripts/weapp_automation.py (reported line 94)May include surrounding context.
python
env = os.environ.copy() if "NODE_PATH" not in env: try: npm_global = subprocess.run( "npm root -g", capture_output=True, text=True, timeout=10, shell=True,

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs the agent to create and run Python scripts and references capabilities that imply shell execution, local file creation, network/WebSocket access, and reading project/application data, but it declares no explicit tool scope or permissions boundaries. That makes the operational authority of the skill ambiguous and increases the risk of over-broad execution, especially because the skill is designed to drive local developer tooling and inspect app state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly supports screenshots, console log reading, WXML extraction, and page data access, all of which can expose secrets, personal data, tokens, internal app state, or proprietary UI content. Omitting privacy and data-handling warnings is risky in this context because the skill is aimed at local testing workflows where real app data and developer credentials may be present.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The so-called console log reader gathers page routes and system information, then exposes them as log output without clear disclosure. In the context of an automation-testing skill, this is more dangerous because logs and reports are commonly exported, shared, or ingested into CI systems, which can propagate unintended sensitive environment details beyond the local machine.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/console_reader.py (reported line 139)May include surrounding context.
python
f.write(script_content) try: result = subprocess.run( ["node", script_path], capture_output=True, text=True,

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/console_reader.py (reported line 344)May include surrounding context.
python
f.write(script_content) try: result = subprocess.run( ["node", script_path], capture_output=True, text=True,

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring and CLI description present this file as a console log reader, focused on reading console output and related logs. However, the PerformanceMonitor class adds a separate capability to collect and export mini program performance/system metrics, which is materially broader than log reading.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The performance collection path reads wx.getSystemInfoSync() and exports the result without any user-facing disclosure or minimization. System/device metadata can reveal host characteristics and environment details that are unnecessary for many test runs, increasing privacy and information-exposure risk if reports are shared or stored insecurely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The form submission scenario explicitly takes a screenshot after populating fields from form_data, which can capture usernames, emails, and potentially more sensitive values if callers supply them. In an automation-testing skill, screenshots are likely persisted to disk and may be shared in reports, making unintended data exposure a realistic privacy risk even though the code is not overtly malicious.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code creates a screenshot directory and later saves screenshots to local files, which is a file-write operation covered by the missing-warning rule for code files. While the module has developer-facing docstrings, there is no confirmation prompt or user-facing notice in the CLI flow warning that image files will be created on disk.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 90% confidence
Finding: The code uses subprocess.run with shell=True to execute 'npm root -g'. Even though the command string is constant, shell execution unnecessarily expands the attack surface by honoring the user's PATH and shell environment, allowing execution of a malicious 'npm' binary or shell behavior in a compromised environment.
Content: Scanner excerpt · scripts/weapp_automation.py (reported line 94)May include surrounding context.
python
env = os.environ.copy() if "NODE_PATH" not in env: try: npm_global = subprocess.run( "npm root -g", capture_output=True, text=True, timeout=10, shell=True,

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The code invokes shell and subprocess execution via npm root -g and node <temp script>, which falls under subprocess or shell execution. Although this is part of the automation implementation, the CLI path shown here does not present a user-visible warning or notice that external commands will be run on the host system.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/weapp_automation.py (reported line 104)May include surrounding context.
python
except Exception: pass result = subprocess.run( ["node", script_path], capture_output=True, text=True,

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest and module docstrings describe console log reading as a core capability, but the code behind that capability calls miniProgram.getSystemInfo() and returns it as logs. This is a direct behavior mismatch because users invoking the advertised log-reading feature will not receive console output at all.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/weapp_launcher.py (reported line 40)May include surrounding context.
python
"""Run a CLI command.""" cmd = [self.cli_path] + args try: result = subprocess.run( cmd, capture_output=True, text=True,

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/weapp_launcher.py (reported line 128)May include surrounding context.
python
def is_running(self) -> bool: """Check if WeChat DevTools is running.""" if sys.platform == "win32": result = subprocess.run( ["tasklist", "/FI", "IMAGENAME eq wechatdevtools.exe"], capture_output=True, text=True )

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/weapp_launcher.py (reported line 134)May include surrounding context.
python
) return "wechatdevtools.exe" in result.stdout.lower() else: result = subprocess.run( ["pgrep", "-f", "wechatwebdevtools"], capture_output=True )

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill directs the agent to write a Python file and execute it locally, but does not warn that this creates files and runs code on the user's system. In a security-sensitive environment, failing to disclose code generation and execution increases the chance of unintended local side effects, especially when combined with shell access and control over local developer tools.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file documents taking screenshots and exporting console logs/reports, which can capture application content, user-entered data, or diagnostic information. The description provides usage examples and storage locations but does not include any user-facing warning about privacy or sensitive data handling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: When --output is used, the script writes structured test results to a file, which may include page paths, screenshots metadata, or form data. The code prints a message after saving, but it does not warn beforehand in the interface or documentation that supplied test inputs and results may be persisted to disk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The inline intent is inconsistent across the file: the public method is documented as system information retrieval, but it delegates to an action named get_logs, while the manifest claims console log reading support. This contradiction can mislead developers about what data is actually being collected.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.