Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a WeChat mini-program development guide, but its broad triggers and declared write/command execution authority need review before installation.
Install only if you expect this skill to help modify and test a local WeChat mini-program project. Review agent actions before allowing file writes or shell commands, especially if the skill activates during unrelated analytics, reporting, or visualization tasks.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<!-- index.wxml -->
<view wx:for="<配置项>" wx:key="id" bindtap="onTap" data-id="<配置项>">
<配置项>
</view>
The invocation keywords are broad and generic enough to match many unrelated requests, while lacking exclusions or disambiguation. In combination with the declared exec/write tool access, this increases the probability of accidental or attacker-induced invocation outside the intended mini-program domain.
The skill presents itself as a WeChat mini-program guidance tool, but its manifest grants exec capability unrelated to narrowly scoped documentation or linting assistance. This expands the attack surface substantially because any prompt-driven workflow can be steered into running arbitrary shell commands under the guise of development help.
The trigger condition says to use the skill for broad data analysis, reporting, statistics, and visualization tasks, which are unrelated to WeChat mini-program development guidance. Overbroad activation criteria can cause the skill to be invoked in inappropriate contexts where its exec and write permissions become available unnecessarily, increasing the chance of misuse or unsafe prompt chaining.
The skill claims to be a 'pure Markdown instruction' tool while also declaring exec and write capabilities, creating a misleading trust boundary. Users or downstream agents may treat it as passive documentation when it can actually modify files and execute commands, enabling prompt-influenced side effects beyond the stated purpose.