ClawHub
Back to skill

Security audit

WeChat MiniApp Deploy

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned for WeChat Mini Program deployment, but it gives agents sensitive deployment and admin-API workflows with under-scoped credential handling examples.

Review this skill before installing. It is not deceptive, but only use it in repos where agents may handle WeChat deployment credentials. Prefer pinned project-local miniprogram-ci installs, masked CI secrets, temporary key files created with restrictive permissions and trap cleanup, and avoid running AppSecret review-submission commands in local or untrusted agent environments.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:18
Finding

Unpinned Global Installation of a Deployment Dependency

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:159
Finding

WeChat API Credentials Embedded in URL Query Strings

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:205
Finding

WeChat CI Private Key Written Unsafely to the Workspace

Content
View full analysis
./private.key VERSION=$(node -p "require('./package.json').version") miniprogram-ci upload \ --pp ./ \ --pkp ./private.key \ --appid $MINI_APPID \ --uv "$VERSION" \ -r 1 \ --desc "$(git log --oneline -1)" \ --enable-es6 true \ --enable-minify true rm ./private.key - name: Generate Preview QR if: github.ref != 'refs/heads/main' run: | echo "$MINI_PRIVATE_KEY" > ./private.key miniprogram-ci preview \ --pp ./ \ --pkp ./private.key \ --appid $MINI_APPID \ -q ./preview.jpg rm ./private.key ``` ### Technical Analysis The workflow writes the complete WeChat CI private key into a predictable plaintext file in the repository workspace. The resulting permissions depend on the runner's current `umask`; the workflow does not explicitly enforce owner-only access. Cleanup is performed by a normal `rm` command after the deployment command. GitHub Actions shell steps generally stop when a command fails, so a failed upload or preview may prevent the cleanup command from running. The key can consequently remain in a retained, inspected, cached, or reused workspace. A predictable path also makes the secret easier for another process on the runner to locate. The workflow does not upload `private.key` as an artifact, and the repository instructions explicitly warn against committing private keys. The vulnerability is therefore unsafe temporary handling rather than deliberate credential exfiltration. ### Attack Path 1. The CI job expands `MINI_PRIVATE_KEY` and writes it to `./private.key`. 2. The file rece ...[truncated 1050 chars]
Remediation
View remediation
"$KEY_FILE" trap 'rm -f "$KEY_FILE"' EXIT HUP INT TERM ``` - Pass `"$KEY_FILE"` to `miniprogram-ci` rather than using a predictable repository path. - Use `printf` instead of `echo` to avoid implementation-specific handling of key contents. - Register cleanup before executing any command that may fail. - Store temporary credentials outside the checked-out repository and any artifact or cache paths. - Use an ephemeral, isolated CI runner wherever possible. - Restrict secret exposure to only the steps requiring the key and ensure each such step declares the required secret environment variables. - Rotate the WeChat CI private key immediately if a failed or retained run may have exposed the workspace. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md
# This must be done via the WeChat MP admin panel or API

# Using WeChat API (requires access_token):
ACCESS_TOKEN=$(curl -s "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=$APPID&secret=$APPSECRET" | node -p "JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')).access_token")

# Submit for review
curl -X POST "https://api.weixin.qq.com/wxa/submit_audit?access_token=$ACCESS_TOKEN" \

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.

md
--desc "$(git log --oneline -1)" \
            --enable-es6 true \
            --enable-minify true
          rm ./private.key

      - name: Generate Preview QR
        if: github.ref != 'refs/heads/main'

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

md
--desc "$(git log --oneline -1)" \
            --enable-es6 true \
            --enable-minify true
          rm ./private.key

      - name: Generate Preview QR
        if: github.ref != 'refs/heads/main'

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill is framed around CI-key-based miniprogram-ci deployment, but it expands into broader WeChat admin API use for audit submission via AppSecret-derived access tokens. That broadens the credential scope and operational surface beyond what a deployment-focused skill strictly needs, increasing the chance that an agent or user handles higher-privilege secrets unsafely.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Introducing APPSECRET-based authentication in a skill otherwise centered on CI private keys encourages use of a more sensitive credential than necessary for the primary task. If copied into local shells, shared runners, logs, or chat transcripts, the AppSecret can enable broader administrative API access than the CI key alone.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The token retrieval example sends the AppSecret to an external endpoint without clearly stating that this must only occur in a secure backend or CI context. Absent that warning, users may run it interactively on developer machines or in agent-driven environments where command history, logs, and process listings can expose sensitive credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md
# This must be done via the WeChat MP admin panel or API

# Using WeChat API (requires access_token):
ACCESS_TOKEN=$(curl -s "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=$APPID&secret=$APPSECRET" | node -p "JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')).access_token")

# Submit for review
curl -X POST "https://api.weixin.qq.com/wxa/submit_audit?access_token=$ACCESS_TOKEN" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

md
# This must be done via the WeChat MP admin panel or API

# Using WeChat API (requires access_token):
ACCESS_TOKEN=$(curl -s "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=$APPID&secret=$APPSECRET" | node -p "JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')).access_token")

# Submit for review
curl -X POST "https://api.weixin.qq.com/wxa/submit_audit?access_token=$ACCESS_TOKEN" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

md
ACCESS_TOKEN=$(curl -s "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=$APPID&secret=$APPSECRET" | node -p "JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')).access_token")

# Submit for review
curl -X POST "https://api.weixin.qq.com/wxa/submit_audit?access_token=$ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "item_list": [{

Static analysis

No suspicious patterns detected.