Security audit

Wechat Miniprogram Toolkit

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent WeChat mini-program development toolkit, but it needs Review because several examples handle payments, identity, analytics, Wi-Fi credentials, deployment, and skill self-updates without enough safeguards.

Install only with close supervision. Require confirmation before it installs packages, edits project files, configures CI/CD, submits releases, or updates its own skill files. Do not paste live merchant keys, AppSecrets, private keys, access tokens, Wi-Fi passwords, or user personal data into prompts or source files, and revise the copied examples to use server-side authorization, secrets managers, consent/privacy controls, and least-privilege database rules.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (26)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill explicitly instructs the agent to install packages, run scripts, generate files, and modify project configuration, which implies file read/write capability, yet no permissions are declared. That mismatch weakens user awareness and policy enforcement because the agent may perform system or repository changes without an explicit capability boundary.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The sample analytics wrapper automatically appends `openid` to every event payload while the same document later states that sensitive information must not be included in analytics. Persistently attaching a stable user identifier to all behavioral telemetry increases privacy risk, enables cross-event profiling, and may violate platform or regulatory data-minimization expectations.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The document explicitly warns not to transmit openid to the frontend, yet later examples return `openid` from cloud functions and persist it in client storage. Although `openid` is not a credential by itself, exposing and storing a stable user identifier on the client increases privacy risk, enables unnecessary identifier leakage through logs/storage, and undermines the guide’s own trust-boundary model.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The example presents an admin-only cloud function but authenticates it with a hardcoded shared secret passed from the client (`adminKey !== 'your-secret-admin-key'`). In this context, any secret embedded in or sent from a mini-program client can be extracted or replayed, so the pattern undermines the stated security boundary and can allow unauthorized destructive admin actions such as deleting posts.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The section labels the example as H5-to-mini-program navigation, but the code uses the `wx-open-launch-app` tag, which is intended for launching an app, not a mini program. In a developer skill, this mismatch can directly mislead implementers into wiring the wrong cross-app launch mechanism, causing broken flows or unintended app-launch behavior in production.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The document explicitly states that payment secrets must be stored in environment variables, but the payment notification handler example hardcodes `MCH_KEY` in source code. In a payment-processing skill, this is especially dangerous because developers may copy the sample verbatim, causing a merchant signing key to be committed to source control, exposed to collaborators, or leaked via logs/build artifacts; compromise of this key can enable forged or manipulated payment-related requests and weaken trust in payment verification flows.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The activation contract matches very broad terms such as '小程序', 'TypeScript', '分享', '扫码', and other generic concepts, causing the skill to trigger in contexts beyond its intended scope. Over-broad activation increases the chance the agent loads powerful workflow instructions unnecessarily and performs irrelevant or risky actions in unrelated tasks.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill says the AI can automatically install SkillHub or other tooling and generate or modify project files, but it does not present a prominent warning or approval gate for those changes. This can lead to unreviewed package installation, command execution, or repository modification, which is risky in developer environments.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The payment and CI/CD sections involve merchant accounts, AppID, repositories, and deployment tooling, but the skill does not clearly warn against exposing secrets such as API keys, certificates, tokens, or payment credentials in chat, code, logs, or workflows. In a payment-related skill, this omission is more dangerous because users are likely to handle live credentials and production deployment material.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The examples describe recurring heartbeat reporting and upload user identifiers, page routes, timestamps, and behavior data to cloud functions, but they do not pair that collection with clear notice, consent, or privacy disclosures. In an analytics skill, this context makes the omission more dangerous because users may be monitored continuously and linked across sessions without transparent disclosure.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The global auto-tracking wrapper captures page show/hide and app show events for all pages by default, creating broad behavioral surveillance with no built-in transparency controls. Because it is framed as a recommended reusable pattern, downstream developers may deploy pervasive analytics without implementing user notice, consent gating, or selective exclusions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide promotes silent login and persistent client-side storage of `openid` without clear privacy guidance, retention limits, or a reason to store a stable identifier locally. This can lead developers to normalize long-lived identifier storage, increasing privacy exposure and the chance of leakage via device compromise, debugging, analytics, or shared client state.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The examples retrieve, display, and store a user phone number without clear consent, minimization, masking, retention, or access-control guidance. Phone numbers are sensitive personal data; careless handling can cause privacy violations, unauthorized disclosure, compliance failures, and account-targeting risks if developers copy the sample directly.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The activation contract uses broad keywords such as '内容审核', '内容安全', 'UGC', and 'security check', which can cause the skill to activate in many generic contexts rather than only when explicitly needed. In an agent setting, unintended invocation can expand the skill’s influence over unrelated workflows, increasing the chance of inappropriate actions, privacy exposure, or incorrect security guidance being applied where it was not requested.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The document demonstrates sending home Wi-Fi credentials over plain HTTP to a local device endpoint without prominently warning about interception, rogue AP/device impersonation, or insecure provisioning flows. Even on a local network, unauthenticated and unencrypted transport of SSID/password can expose household credentials to nearby attackers or malicious devices during onboarding.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation contract is overly broad and can trigger this skill for generic video, education, or upload-related requests that are outside strict live-streaming/TRTC scope. In an agent setting, overbroad routing can cause the wrong skill to handle requests involving payments, identity, media, or cloud operations, increasing the chance of unsafe guidance or unintended data-handling behavior.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guide instructs users to upload personal video to cloud storage but does not include any consent, retention, access-control, or privacy warning. Because user videos commonly contain faces, voices, location clues, and other sensitive content, omitting these safeguards can lead to accidental collection and exposure of personal media.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The example places nickname, avatar URL, and order ID into the customer-service session context without any minimization guidance or privacy notice. This can expose unnecessary personal data to downstream systems, logs, or support staff, increasing privacy and compliance risk if over-collected or retained.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The implementation describes obtaining and using an access token derived from AppSecret for outbound messaging but does not warn about secret handling, authorization boundaries, or sensitive logging. In a real deployment, poor credential storage or exposing request/response details could allow attackers to abuse the messaging API or impersonate the application.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The example caches access tokens in a database and retrieves new tokens over the network, but it omits warnings about protecting the token store and preventing overly broad database access. A leaked access token can enable unauthorized API calls during its validity window, and insecure storage practices make token theft easier.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation contract is very broad and can trigger on many generic WeChat deep-linking or handoff discussions, even when the user may not need this specific skill. Over-broad activation increases the chance of inappropriate or unintended skill invocation, which can inject irrelevant guidance into sensitive implementation flows and reduce trustworthiness of security-relevant advice.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The template implements silent login and persists the user's openid in local storage without documenting identity handling, retention, or consent expectations. Although openid is not a secret credential by itself, it is a persistent identifier, and normalizing silent collection/storage without privacy notice can lead developers to ship identity-related tracking behavior that violates least-visibility and privacy expectations.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The cloud upload helper makes it trivial to transmit local files to cloud storage but provides no warning about sensitive data handling, user consent, file type restrictions, or content review. In a full-stack mini-program toolkit, this omission can cause downstream apps to upload personal or regulated content without adequate disclosure or validation.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The activation contract includes very broad generic triggers such as 'share' and '邀请好友', which can cause the skill to load in contexts unrelated to this specific mini-program toolkit. Over-broad activation increases the chance of unintended invocation, context contamination, and inappropriate handling of user requests, especially in an automated agent environment where trigger matching may be loose.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document provides code for share tracking via wx.reportEvent and propagation of source identifiers through share parameters, but it does not clearly disclose that user interaction and attribution data will be collected. This can lead to privacy compliance issues, invisible behavioral tracking, and misuse of identifiers such as openid-derived values in shared links if copied directly into implementations.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/live-stream.md:62

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/messaging.md:365