Security audit

AI小程序前后端SKILL

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad but disclosed Ushopun mini-program mall development guide; it includes sensitive commerce features, but they fit the stated platform purpose.

Install only if you are building a Ushopun WeChat mini-program mall. Treat the connector ApiToken, JWT tokens, phone numbers, passwords, addresses, wallet payout details, and payment/order actions as sensitive; use placeholders or environment/config storage, and add explicit user confirmation before generated code submits orders, payments, withdrawals, posts content, or sends private messages.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Ae1

High

Category: analysis-evasion
Content: 调用示例。当用户需要开发对接 Ushopun 后端（优社云）的微信小程序商城时调用此 Skill。后端接口文档参考同目录 openapi.json（#File ./openapi.json，servers 为 {tenant}.ushopun.com 泛域名模板，开发填 dev，正式替换租户子域名）。"
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: 调用示例。当用户需要开发对接 Ushopun 后端（优社云）的微信小程序商城时调用此 Skill。后端接口文档参考同目录 openapi.json（#File ./openapi.json，servers 为 {tenant}.ushopun.com 泛域名模板，开发填 dev，正式替换租户子域名）。"
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: 调用示例。当用户需要开发对接 Ushopun 后端（优社云）的微信小程序商城时调用此 Skill。后端接口文档参考同目录 openapi.json（#File ./openapi.json，servers 为 {tenant}.ushopun.com 泛域名模板，开发填 dev，正式替换租户子域名）。"
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: 调用示例。当用户需要开发对接 Ushopun 后端（优社云）的微信小程序商城时调用此 Skill。后端接口文档参考同目录 openapi.json（#File ./openapi.json，servers 为 {tenant}.ushopun.com 泛域名模板，开发填 dev，正式替换租户子域名）。"
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Missing User Warnings

High

Confidence: 95% confidence
Finding: The wallet withdrawal endpoint handles highly sensitive payout details and initiates a financial action, yet the surrounding skill description does not disclose these capabilities. In an agent skill context, exposing withdrawal operations without strong user-awareness cues increases the risk of accidental or socially engineered fund-transfer actions.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The prompt defines the agent role exclusively as a WeChat Mini Program expert for a Chinese platform and the entire skill content is written to operate in a China-specific language and ecosystem without any opt-in or alternative locale handling. This can violate language/locale policy when the skill is invoked by users who did not choose Chinese-language or China-region behavior.

Session Persistence

Medium

Category: Rogue Agent
Content: | 端点常量 | HTTP | 子路由 | 参数 | 返回 | 鉴权 | |----------|------|--------|------|------|------| | `pickuplist` | GET | /pickuplist | - | List\<MoPickupPoint\> | - | | `shopsearch` | GET | /shopsearch | keyword, lat, lng, page=1, size=20 | object | - | | `shipments` | GET | /shipments | oid | MoShipmentBrief | ✔ |
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

Category: Rogue Agent
Content: | 端点常量 | HTTP | 子路由 | 参数 | 返回 | 鉴权 | |----------|------|--------|------|------|------| | `pickuplist` | GET | /pickuplist | - | List\<MoPickupPoint\> | - | | `shopsearch` | GET | /shopsearch | keyword, lat, lng, page=1, size=20 | object | - | | `shipments` | GET | /shipments | oid | MoShipmentBrief | ✔ |
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

Category: Rogue Agent
Content: | 端点常量 | HTTP | 子路由 | 参数 | 返回 | 鉴权 | |----------|------|--------|------|------|------| | `pickuplist` | GET | /pickuplist | - | List\<MoPickupPoint\> | - | | `shopsearch` | GET | /shopsearch | keyword, lat, lng, page=1, size=20 | object | - | | `shipments` | GET | /shipments | oid | MoShipmentBrief | ✔ |
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

Category: Rogue Agent
Content: | 端点常量 | HTTP | 子路由 | 参数 | 返回 | 鉴权 | |----------|------|--------|------|------|------| | `pickuplist` | GET | /pickuplist | - | List\<MoPickupPoint\> | - | | `shopsearch` | GET | /shopsearch | keyword, lat, lng, page=1, size=20 | object | - | | `shipments` | GET | /shipments | oid | MoShipmentBrief | ✔ |
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

Category: Rogue Agent
Content: | 端点常量 | HTTP | 子路由 | 参数 | 返回 | 鉴权 | |----------|------|--------|------|------|------| | `pickuplist` | GET | /pickuplist | - | List\<MoPickupPoint\> | - | | `shopsearch` | GET | /shopsearch | keyword, lat, lng, page=1, size=20 | object | - | | `shipments` | GET | /shipments | oid | MoShipmentBrief | ✔ |
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The login endpoint accepts account/phone and password data, but the surrounding natural-language description only labels it as a login action and does not warn that sensitive credentials will be sent to the server. For a manifest/OpenAPI description file, this is a missing disclosure about handling sensitive user data.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This endpoint handles old and new password values, but its description only states that it modifies a password and lists the fields. The documentation does not explicitly warn users that highly sensitive credentials are being submitted to the backend.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The reset-password endpoint collects phone number, verification code, and new password, but the description does not warn that these sensitive account-recovery details will be transmitted and processed. In markdown/manifest-style API descriptions, this omission is a missing user warning.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The manifest focuses on a shopping mini-program and its normal purchase lifecycle, but the API also supports agent upgrades, distribution info, bonus summaries, invitees, and agent orders under `/api/v2/agents/*`. This is a separate affiliate/distribution business capability that is not reflected in the declared purpose.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest describes a WeChat mini-program mall front-end covering standard commerce flows and Ushopun backend integration, but this OpenAPI file also exposes diary/blog creation and retrieval endpoints (`/api/v2/blog/*`) and private-message operations (`/api/v2/pm/*`). Those capabilities are not mentioned in the skill description and materially broaden the skill from mall storefront integration into social-content and messaging functionality.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The endpoint submits an order, which can affect user data and potentially trigger payment workflows, but the summary and request description do not include any cautionary disclosure. Users are not warned that shipping, payment, and order details will be sent and may result in a purchase action.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The manifest emphasizes storefront and transaction-chain pages such as home, product, cart, checkout, and orders, but this specification also includes wallet balance retrieval, recharge orders, withdrawals, and recharge-card redemption. These stored-value and payout capabilities are financially sensitive extensions beyond the described mall front-end scope.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The title and endpoint descriptions throughout the file are presented in Chinese without offering any language or locale choice. This can violate language/locale policy when a skill or API spec forces one language without explicit opt-in or documented regional justification.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: Prompt.md:84

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:173