ClawHub
Back to skill

Security audit

Wechat Miniprogram Helper

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward WeChat Mini Program helper that creates a small local starter project and provides development guidance.

Before running the scaffolder, choose an empty target directory unless you intentionally want to overwrite the fixed starter files with --force. Treat the DevTools TLS/domain-check bypass as local debugging only and configure proper HTTPS domains before publishing.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/scaffold_miniprogram.py (reported line 223)May include surrounding context.

python
help="Mini Program AppID (default: touristappid / guest mode)")
    parser.add_argument("--name", default="miniprogram", help="Project name")
    parser.add_argument("--force", action="store_true",
                        help="Overwrite existing files in the target directory without prompting")
    args = parser.parse_args()

    try:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill instructs the agent to run a local scaffolding script that writes a complete project to a user-specified target directory, but the manifest declares no explicit tool scope or permission boundary for file-writing behavior. That mismatch increases the chance of unintended or overbroad filesystem writes because the agent may exercise write capabilities without a clearly constrained policy.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description includes trigger phrases like "做个小程序" and broad references to "微信小程序" without clear exclusion conditions or scope boundaries. These phrases could overlap with general conversational requests and cause the skill to activate in situations where the user is not specifically asking for this end-to-end WeChat Mini Program workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The "When To Use" section lists broad utterances such as "小程序助手" and "小程序模板" and general states like the user wanting a boilerplate project, but does not specify what should not trigger the skill. Without explicit constraints or exclusion examples, the activation conditions are too open-ended for reliable routing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The document explicitly tells developers they can disable legal domain, TLS, and HTTPS verification in local development, but it does not immediately warn that this should be temporary and never relied on for real testing or release workflows. That can normalize insecure practices, increase the chance of testing against untrusted endpoints, and cause developers to overlook transport-security issues until late in the lifecycle.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file contains all operational guidance in Chinese and does not state that the skill is intended only for Chinese-speaking users or a China-specific context. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.