Security audit

微信小程序选题共创

Security checks for vulnerabilities and agentic risk

Overview

This is a prompt-only Chinese workflow skill for planning WeChat mini-program ideas, with no executable code or hidden installation behavior.

Installers should understand this skill will steer mini-program idea discussions through a fixed Chinese-language workflow and may perform web searches. If using its reference specs to build an app, add clear privacy copy, retention rules, consent, and delete/clear-all controls for location, photos, account identifiers, and AI-processed user input.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill description is broad enough to match many ordinary requests about app ideas, idea collection, planning, or development direction, which can cause incorrect routing and unintended activation. When a skill activates outside its intended scope, it may override safer or more relevant system behavior, force unnecessary web searching, and steer users into a rigid workflow that is not appropriate for their request.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The skill is written to operate only in Chinese and does not provide a language-choice mechanism or justify a hard locale restriction. If triggered for users interacting in other languages, it can produce inaccessible or misleading output, increasing the chance of misunderstanding product, compliance, or implementation guidance.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The manifest description and scope are broad enough that the skill may be invoked for common product or brainstorming requests that are not specifically intended for this skill. Overbroad routing can cause prompt hijacking of unrelated conversations, reducing invocation control and potentially exposing users to irrelevant or unintended behavior.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: Trigger phrases such as '做小程序' and '小程序点子' are generic and likely to overlap with many normal user requests, making accidental or excessive invocation more likely. This weak invocation boundary can let the skill capture conversations beyond its intended scope, which is a security and reliability concern in agent routing.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger description is broad enough to match many generic requests about mini-program ideas, directions, or topic collection, which can cause the skill to activate outside its narrow intended scope. Over-broad activation is dangerous because it increases the chance this skill overrides more appropriate domain-specific skills and forces unnecessary web searches and workflow constraints on unrelated user requests.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The manifest uses broad activation language such as '做小程序', '小程序选题', and generic description text that can match many ordinary product or brainstorming requests. This can cause the skill to activate outside its intended scope, increasing the chance of prompt hijacking-by-routing, irrelevant handling of user requests, or unintended exposure of downstream prompt behavior in unrelated conversations.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The spec explicitly collects precise location data and photos, both of which are sensitive, but it does not require clear user-facing disclosure about how long this data remains on the device, that it is stored locally, or how users can remove it. In a location-memory app, stale local records can expose home, office, parking, or personal-item locations to anyone with device access, making the omission a meaningful privacy weakness.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The spec includes single-record deletion but does not require a confirmation step, undo option, or warning that removal is irreversible in a purely local-storage design. Because there is no backend or recovery path, accidental deletion can permanently destroy user data such as saved item locations and associated notes/photos.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The document describes sending user input to an AI model and storing records keyed by `_openid`, but the operational flow does not clearly surface this collection and processing to users at the point of use. That creates a privacy/compliance weakness: users may submit sensitive business or personal data without informed notice, increasing legal and trust risk if the data is retained, audited, or leaked.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill specifies collection and local storage of precise GPS coordinates and item photos, but it does not clearly warn users that this sensitive data will remain on-device and could expose home layouts, routines, or valuable-item locations if the device is shared, lost, or compromised. In this context, the omission is a real privacy/security weakness because the app is specifically designed to record where personal belongings are stored.

Static analysis

No suspicious patterns detected.