Security audit

小程序开发工具

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a WeChat mini-program development guide, but it requests write and command authority while also containing mismatched data-analysis triggers and vague create/modify/delete/import/export behavior.

Review this skill before installing. It appears to be a mini-program development helper, but its activation wording and operation claims should be narrowed; only use it for a specific project directory and confirm any file writes, deletes, imports, exports, or shell commands before allowing them.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill is presented as a mini-program guidance/spec-checking tool, but its implementation text claims operational capabilities such as create/modify/delete, save/import/export, and runtime configuration. This mismatch can cause an agent or user to authorize broader file or system-affecting actions than expected, increasing the chance of unsafe execution under a misleading label.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The trigger conditions instruct use for data analysis, report generation, statistical insights, and visualization, which do not match a mini-program development guidance skill. This mismatch can cause the skill to be invoked in unrelated contexts, where its tools or instructions may operate on unintended inputs and produce unsafe or confusing behavior.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The file explicitly frames the skill as mini-program development guidance, yet the trigger-condition section redirects it toward unrelated data-analysis tasks. This inconsistency weakens operator trust and can lead to accidental invocation outside its safe domain, where available tools like exec/write may be applied without appropriate relevance or guardrails.

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger condition is overly broad and domain-mismatched, encouraging invocation whenever users need data analysis or reporting. In an agent environment, broad triggers can route unrelated tasks into a skill that has exec/write capabilities, increasing the risk of unintended command execution, file modification, or misuse in contexts the user did not intend.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill describes modify/delete operations and command-execution-adjacent behavior without clear warnings, constraints, or approval requirements. In a skill that exposes read/exec/write tools, omitting these guardrails can normalize potentially system-affecting actions and make accidental destructive behavior more likely.

Static analysis

No suspicious patterns detected.