Security audit

wechat-miniprogram-dev

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent WeChat mini-program deployment guide, but it ships deployment commands that dynamically run an unpinned package with access to a private-key path and includes project-specific operational identifiers.

Review this skill before installing or running its script. Replace the project-specific AppID/environment values with your own placeholders, keep private keys outside the repository where possible, and use a pinned or lockfile-controlled `miniprogram-ci` instead of floating `npx` execution for deployment commands.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: scripts/deploy.sh:16
Finding: Unpinned Third-Party Package Execution Through npx
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/deploy.sh:12
Finding: Unquoted and Unvalidated Cloud Function Name in Deployment Command
Content: View full analysis
Remediation: View remediation
&2 return 2 fi printf 'Deploying cloud function: %s\n' "$FUNC_NAME" npx --no-install miniprogram-ci cloud functions upload \ --pp "$PROJECT_PATH" \ --pkp "$PRIVATE_KEY" \ -r "$ROBOT" \ -e "$ENV_ID" \ -n "$FUNC_NAME" \ -p "./cloudfunctions/$FUNC_NAME" \ --rnpm } ``` Additional hardening measures: 1. Quote every variable expansion used as a command argument. 2. Validate that `./cloudfunctions/$FUNC_NAME` exists and resolves beneath the expected `cloudfunctions` directory before deployment. 3. Reject function names beginning with hyphens even if future naming rules are relaxed. 4. Enable stricter shell behavior, after accounting for expected failures: ```bash set -euo pipefail ``` 5. Use `local FUNC_NAME="$1"` and `local` declarations for loop variables to avoid unintended global state. 6. Where supported by the invoked CLI, use an end-of-options marker before positional values; this does not replace input validation. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (15)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description and top-level heading are written entirely in Chinese and present the skill as a general-purpose guide, but there is no indication that Chinese output is optional or that the skill is intentionally restricted to Chinese-speaking users. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The skill recommends executing npx miniprogram-ci without pinning an exact package version. This can cause users to run whatever version is current on the registry at execution time, creating supply-chain risk from malicious updates, dependency compromise, or breaking behavior in deployment workflows that handle app credentials and private keys.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: This command uses npx miniprogram-ci without an exact version pin, so the executed package may change over time. In this skill's context, the command is used for preview operations with access to the WeChat app ID and private key path, which increases the impact of a compromised or unexpected package version.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The upload example invokes npx miniprogram-ci without pinning a specific version, exposing users to registry-side package drift and supply-chain compromise. Because this workflow is part of deployment and references sensitive signing material, an attacker-controlled or broken package could affect build integrity or leak secrets.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The markdown exposes sensitive operational details including a real AppID, cloud environment identifier, a private key path, and deployment commands that directly reference the signing key. Even though the key material itself is not included, publishing credential locations and deployment workflow details lowers the barrier for misuse, increases the chance of accidental key exposure, and normalizes unsafe handling of sensitive build credentials.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The script invokes npx miniprogram-ci without pinning an exact package version, so execution depends on whatever version is resolved at runtime. In a deployment script that uses a private key and performs remote publishing, this creates a supply-chain risk: a malicious or compromised upstream package version could execute arbitrary code and exfiltrate credentials or tamper with releases.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This shell script invokes remote deployment commands that upload cloud functions and authenticate with a private key path, but the code provides no comment or user-facing warning that credentials will be used and project data will be transmitted to an external service. Because this is a code file, such networked deployment behavior should include at least some disclosure unless the warning is documented elsewhere, which is not visible in this file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The preview function performs a remote preview operation and writes an output file to ./preview-qrcode.png, but there is no confirmation, warning, or explanatory comment describing either the network transmission or local file creation. For code files, safety-relevant file writes and external calls should have some visible disclosure to the user.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The preview path also uses unpinned npx miniprogram-ci, allowing a different package version to be fetched and executed at runtime. Because preview generation uploads project content and uses signing credentials, an attacker controlling the dependency resolution path could gain code execution, leak source, or steal the private key.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This function performs a remote upload/publish action and authenticates with a private key, yet the script does not visibly warn the user that code and metadata will be transmitted or that a publish-like operation is occurring. Even though upload is part of the function name, the criteria still call for some user disclosure within the code when sensitive operations occur.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The upload command performs a production-relevant remote publish while resolving miniprogram-ci dynamically via npx. This is dangerous because a compromised package version or registry response could alter the uploaded artifact, execute arbitrary code on the build host, or misuse the private key during release.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Natural-language strings in comments and usage output are Chinese-only, including the command help shown to users later in the script. The policy requires avoiding forced language constraints unless the skill offers a choice or clearly documents a justified locale restriction, which this file does not.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script prints its usage instructions exclusively in Chinese, which is a user-facing locale decision embedded in the file. There is no visible option to switch languages and no documented justification that the script is restricted to a Chinese-only audience.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.