Security audit

云开发-微信支付

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent WeChat Pay integration guide, but its recovery instructions include a client-triggered forced-refund path without adequate authorization or normal checks.

Review carefully before installing or using. Do not copy the force_refund pattern into a public Mini Program path as written; refunds should require explicit admin/operator authorization, verified order ownership or eligibility, idempotency, audit logging, a short-lived feature flag or backend-only job, and confirmed sandbox/production environment selection.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/gotchas.md:278
Finding: Unauthenticated Forced-Refund Action Enables Unauthorized Financial Operations
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The comment states the force_refund action does not require a user auth token, which conflicts with the surrounding payment guidance and encourages implementers to omit authentication on a refund-capable path. Even if WeChat cloud-call context exists, that is not a substitute for application-layer authorization; without explicit authZ checks, any caller who can reach the function may attempt refunds against arbitrary order IDs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill gives operational guidance for live payment creation, refunds, and order-state changes without an explicit warning that these actions can affect real money and production records. In a payments context, omission of safety boundaries increases the chance that an agent or developer executes refund or order-management steps against live systems during debugging or review workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The backfill/debugging section includes querying live orders and introducing a temporary force-refund path, but it does not clearly warn that refunds are financially irreversible and could impact real customer orders if misused. In this context, a force-refund mechanism lowers normal business-logic safeguards, so insufficient caution materially raises the risk of accidental or unauthorized refunds.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documented temporary force_refund flow exposes a server-side capability to trigger refunds directly from a client-initiated path and explicitly bypasses normal status checks. In a payment context, any refund primitive that is callable without strict authorization, ownership validation, idempotency controls, and audit checks can be abused to issue unauthorized refunds or probe order records.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The sample explicitly recommends bypassing normal status checks to invoke refunds as a gradual workaround for historical failures. In a financial workflow, normal checks are the control boundary preventing duplicate, premature, or unauthorized refunds, so documenting their bypass materially increases the chance that developers deploy unsafe recovery code into production.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file is entirely written in Chinese and does not indicate that language selection is optional or limited to a justified region-specific audience. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.