Wechat Miniprogram Helper

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 9:58 AM UTC
• Version: 0.1.1

Overview

This skill is a coherent WeChat Mini Program helper that writes a small scaffold project only when invoked for that purpose.

Install this if you want WeChat Mini Program scaffolding and guidance. Use a new or clearly intended project directory when running the scaffolder, and avoid --force unless you are comfortable overwriting the listed scaffold files in that directory.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Self-Modification

High

• Category: Rogue Agent

Content

help="Mini Program AppID (default: touristappid / guest mode)")
    parser.add_argument("--name", default="miniprogram", help="Project name")
    parser.add_argument("--force", action="store_true",
                        help="Overwrite existing files in the target directory without prompting")
    args = parser.parse_args()

    try:

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill instructs the agent to run a local scaffolding script that writes a full project to a user-supplied target directory, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization gap: an agent may perform file-writing actions without clear sandboxing or user-visible constraints, increasing the risk of unintended filesystem modification if the skill is activated or its arguments are mishandled.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description lists triggers such as "做个小程序" and especially "小程序报错", which are broad and could activate on many generic mini-program-related requests without clearly delimiting when this skill should or should not be used. The file provides examples of matching phrases, but no exclusion conditions or negative examples to narrow scope and avoid unintended invocation collisions.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Statements like "User wants a boilerplate mini program project to start from" and short trigger phrases such as "小程序助手" are broad and do not clearly distinguish this skill from other app-development or debugging skills. Because there are no explicit non-applicable cases, the activation scope remains ambiguous.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The title and usage description state the skill is intended for directly matching and fixing user-posted errors in Chinese, with no indication that other languages are supported or that the user can opt into this locale. This is a natural-language policy concern because it imposes a specific language context without explicit user choice or documented regional justification.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This markdown file is entirely written in Chinese and does not indicate that the user can select another language. Under the language/locale policy criterion, forcing a single language without opt-in can be considered a natural-language policy violation.

Static analysis

No suspicious patterns detected.