Security audit

微信小程序选题共创

Security checks for vulnerabilities and agentic risk

Overview

This is a prompt-only Chinese mini-program planning skill with disclosed web-search workflow and reference specs, not executable code or hidden system access.

Install only if you want Chinese-language assistance for WeChat mini-program ideation and SOP planning. Avoid putting confidential business details into web-search-driven brainstorming, and if you implement the included example specs, add clear privacy notices, retention limits, delete/export controls, and user consent for location, photos, AI processing, and _openid-linked cloud records.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger description is broad enough to match many ordinary conversations about mini-program ideas, development direction, or collecting topics, which can cause the skill to activate outside a narrowly intended scope. Over-broad activation is risky because the skill then imposes mandatory web-search and workflow constraints on unrelated requests, increasing the chance of inappropriate tool use, user confusion, or policy-bypassing behavior through unintended routing.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description defines activation using broad natural-language conditions like users saying they want to make a mini-program, collect topics, ask for directions, or turn ideas into SOPs. Because these conditions span multiple adjacent intents, the skill can capture conversations beyond its intended boundaries, leading to incorrect invocation and unsafe or low-quality task routing.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrase list includes very generic phrases such as “做小程序” and “小程序点子”, which can match many ordinary user requests outside the intended narrow workflow. Overly broad activation increases the chance the skill is invoked in the wrong context, causing prompt hijacking of unrelated conversations or routing users away from more appropriate skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger description is broad enough to match common phrases like '有点子想推到可落地SOP' or general discussion about mini-program directions, which can cause the skill to activate outside its intended scope. Overbroad activation can route unrelated conversations into this workflow, causing unwanted web searches, irrelevant guidance, and possible exposure of user context to external search unnecessarily.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrase set includes broad natural-language terms such as “做小程序” and “小程序点子”, which can overlap with many ordinary user requests about mini-programs. This can cause the skill to activate outside its intended niche, increasing the chance of prompt hijacking, inappropriate routing, or accidental interception of unrelated requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document specifies storing user-submitted rawInput, inferred intent (understood), generated outputs, and quota data keyed by _openid, but it does not define retention limits, deletion behavior, minimization, or explicit user-facing notice/consent beyond a brief privacy-guidance mention. Because the skill handles free-form text that may contain business-sensitive or personal information, persistent storage without clear disclosure and lifecycle controls creates a real privacy and compliance risk.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The spec instructs the app to collect precise location data and photos and store them locally, but it does not clearly require a user-facing warning that this sensitive data remains on-device and may be exposed to anyone with access to the phone, backups, or screenshots. Because the app is explicitly designed to record where valuables or personal items are stored, misuse or device compromise could reveal sensitive behavioral and physical-location information.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The system prompt instructs the skill to ask clarification questions in colloquial language and avoid terminology, but the entire skill specification is written to operate in Chinese and does not provide any user opt-in or language-selection mechanism. This creates a natural-language policy risk because the skill appears to force a specific language/locale without documenting choice or exception.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document instructs the app to collect precise location data and photos, then store them locally, but it does not clearly warn users that these sensitive records persist on the device until deleted. On a shared, lost, resold, or compromised device, locally stored records could expose where valuables are kept or reveal private spaces through photos and room labels.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The entire skill is written as Chinese-only operational guidance and does not indicate that users may interact in another language or choose a locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The display name, description, and category are all presented only in Chinese, which may impose a language/locale assumption without any stated user opt-in or justification. Under the policy, locale-specific behavior should either offer a user choice or clearly document why the language constraint is required.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The display name, description, category, tags, and triggers are entirely in Chinese, which implicitly constrains the skill's language/locale behavior without offering user opt-in or documenting that the skill is intentionally limited to a Chinese-language audience. Under the policy, locale-specific behavior should either be optional for users or clearly justified as region-specific.
Content: No source excerpt is available for this finding.