T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:428- Finding
Persistent Agent Memory Poisoning Through Unvalidated Self-Modification
- Content
View full analysis
- Remediation
View remediation
Security audit
Wechat Miniprogram Toolkit
Security checks for vulnerabilities and agentic risk
Overview
This is mostly a WeChat Mini Program development guide, but it under-controls persistent self-modification and includes several unsafe credential/admin examples.
Review this skill before installing. Its normal purpose is app development, but do not allow automatic edits to SKILL.md or reference files, and treat generated payment, admin, CI, token, phone-number, and Wi-Fi code as drafts that require security review before production use.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (7)
T09 · Insecure Skill Coding Practices
Error
- Location
references/hardware.md:504- Finding
Home Wi-Fi Credentials Transmitted Over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/cloud-dev.md:231- Finding
Privileged Cloud Operation Authorized by a Client-Supplied Static Secret
- Content
View full analysis
{ const { adminKey } = event if (adminKey !== 'your-secret-admin-key') { return { code: -1, message: 'No permission' } } await db.collection('posts').doc(event.postId).remove() return { code: 0 } } ``` ### Technical Analysis The cloud function performs an administrator-only deletion after comparing a caller-provided value against a static shared key. The authorization decision does not use the authenticated WeChat identity supplied by `cloud.getWXContext()`, a server-controlled role assignment, or a per-request authorization mechanism. Any caller who learns the shared key can replay it indefinitely. If copied into client code, distributed configuration, logs, documentation, or source control, the key becomes available to untrusted users. The placeholder also encourages developers to hardcode a production replacement into the cloud function. Cloud functions can bypass normal client database permission rules, so weak authorization at this layer exposes backend-level privileges. ### Attack Path 1. A developer follows the template and replaces the placeholder with a static production key. 2. The Mini Program or another caller sends that key in the cloud-function event. 3. An attacker extracts it from client code, request instrumentation, logs, leaked source, or another authorized user. 4. The attacker invokes the cloud function directly with the recovered `adminKey`. 5. The attacker supplies arbitrary `postId` values. 6. The cloud function bypasses client database rules and deletes the selected records. ### Impact Assessment An attacker who obtains the shared key receives the deletion privilege implemented by the cloud function. In the shown example, this permits deletion of a ...[truncated 183 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/ci-cd.md:178- Finding
Deployment Private Key Materialized Without Restrictive Permissions or Guaranteed Cleanup
- Content
View full analysis
private.weapp.key node scripts/build-weapp.js env: WEAPP_APPID: ${{ secrets.WEAPP_APPID }} WEAPP_PRIVATE_KEY: ${{ secrets.WEAPP_PRIVATE_KEY }} ``` The release workflow repeats the pattern: ```yaml - name: Install miniprogram-ci run: | npm install miniprogram-ci -D echo "${{ secrets.WEAPP_PRIVATE_KEY }}" > private.weapp.key - name: Submit code audit run: node scripts/submit-audit.js env: WEAPP_APPID: ${{ secrets.WEAPP_APPID }} WEAPP_PRIVATE_KEY: ${{ secrets.WEAPP_PRIVATE_KEY }} WEAPP_APP_SECRET: ${{ secrets.WEAPP_APP_SECRET }} ``` ### Technical Analysis The workflow writes a long-lived deployment credential into the repository workspace without first setting a restrictive umask or explicitly applying mode `0600`. It does not provide a guaranteed cleanup step after the credential is consumed. The private key is also unnecessarily exposed through an environment variable even though `miniprogram-ci` reads it from a file. Every dependency, build script, and later workflow command running in the same job may be able to read the workspace file or inherited environment. ### Attack Path 1. The workflow retrieves `WEAPP_PRIVATE_KEY` from GitHub Secrets. 2. The key is written to `private.weapp.key` in the checked-out workspace. 3. A compromised dependency, malicious lifecycle script, altered build script, or later workflow step reads the file or environment variable. 4. The malicious component transmits the private key outside the CI environment. 5. The attacker uses the stolen key with the associated AppID to upload or release unauthorized Mini Program builds. ### Impact Assessment The exp ...[truncated 381 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/miniapp-handoff.md:172- Finding
Authentication Token Disclosed Through Android Debug Logging
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/typescript.md:479- Finding
Bearer Token Stored in Plaintext Client Storage
- Content
View full analysis
{ constructor(private key: string) {} get(): T | null { const raw = wx.getStorageSync(this.key) if (!raw) return null try { return JSON.parse(raw) as T } catch { return null } } set(value: T): void { wx.setStorageSync(this.key, JSON.stringify(value)) } remove(): void { wx.removeStorageSync(this.key) } } const tokenStorage = new Storage('token') tokenStorage.set('abc123') ``` ### Technical Analysis The generic storage wrapper explicitly demonstrates persisting an authentication token with `wx.setStorageSync`. The stored value has no confidentiality protection, expiry metadata, rotation mechanism, audience restriction, or server-side revocation behavior. The rest of the Skill recommends using WeChat's server-derived identity context, so a persistent client bearer token is generally unnecessary for native cloud-function authentication. Presenting token storage as a routine example encourages implementations that expand the impact of client compromise. ### Attack Path 1. The application receives or creates a bearer token. 2. The token is serialized into synchronous client storage. 3. Compromised application code, an unsafe dependency, debugging access, device extraction, or another local attack reads the `token` entry. 4. The attacker copies the recovered value. 5. The attacker replays the token against the backend until it expires or is revoked. ### Impact Assessment The attacker obtains the privileges represented by the stored token, potentially including authenticated API access and user impersonation. The scope persists beyond the original application process and may survive restarts. The impact increases substantially if the token is long-lived or accepted ...[truncated 29 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:65- Finding
Unpinned Third-Party Package Installation Instructions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (95)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md AI 将参照 references/project-init.md 自动生成完整项目结构
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md AI 将参照 references/project-init.md 自动生成完整项目结构
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md AI 将参照 references/project-init.md 自动生成完整项目结构
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md AI 将参照 references/project-init.md 自动生成完整项目结构
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md AI 运行 scripts/analyze_subpackages.py，输出 app.json 配置
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md AI 运行 scripts/analyze_subpackages.py，输出 app.json 配置
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md AI 运行 scripts/analyze_subpackages.py，输出 app.json 配置
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md AI 运行 scripts/analyze_subpackages.py，输出 app.json 配置
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md AI 运行 scripts/analyze_subpackages.py，输出 app.json 配置
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 云开发（CRUD/聚合/事务/权限）| `references/cloud-dev.md` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 云开发（CRUD/聚合/事务/权限）| `references/cloud-dev.md` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 微信支付（JSAPI/下单/退款）| `references/payment.md` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 微信支付（JSAPI/下单/退款）| `references/payment.md` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 客服消息 / 订阅消息 | `references/messaging.md` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 客服消息 / 订阅消息 | `references/messaging.md` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 内容安全 / 内容审核 | `references/content-safety.md` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 内容安全 / 内容审核 | `references/content-safety.md` |
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md const openid = cloud.getWXContext().OPENID // 微信自动注入 // 页面按钮授权 <!-- 头像选择按钮 --> <button open-type="chooseAvatar" bindchooseavatar="onChooseAvatar"> <image src="{{avatarUrl}}" /> </button>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md const openid = cloud.getWXContext().OPENID // 微信自动注入 // 页面按钮授权 <!-- 头像选择按钮 --> <button open-type="chooseAvatar" bindchooseavatar="onChooseAvatar"> <image src="{{avatarUrl}}" /> </button>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text ```xml <!-- index.wxml --> <view id="box" class="box" bindtap="handleTap">点我</view>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text ```xml <!-- index.wxml --> <view id="box" class="box" bindtap="handleTap">点我</view>
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The phone-number flow handles highly sensitive personal data but lacks explicit warnings about minimization, masking, storage controls, consent, and prohibited logging/display patterns. In an authentication/reference guide, this omission is risky because implementers may copy the sample directly, leading to over-collection or accidental disclosure of phone numbers in UI, logs, or weakly protected database fields.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### 3.4 私密配置（云托管控制台） > ⚠️ 以下敏感信息**绝对不能**写在代码或 .env 文件中，必须配置到云托管控制台「环境配置 → 私密配置」： | 变量名 | 说明 | 配置位置 | |--------|------|---------|
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The Wi-Fi provisioning example sends the user's home SSID and password to a local device over plain HTTP, exposing sensitive credentials to interception by any party able to observe or interfere with the hotspot/local network path. In a hardware onboarding context this pattern may be common, but presenting it without prominent warnings, origin/authentication checks, or a safer pairing channel normalizes insecure credential handling and can lead developers to ship credential exposure into production.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
2.4 直播间页面
xml <!-- pages/live/room.wxml --> <view class="room"> <!-- 直播播放器（微信直播插件）--> <live-player
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/live-stream.md:62
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/messaging.md:365