WeChat MiniProgram CloudBase Deploy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:11 AM UTC
• Version: 1.0.0

Overview

The skill is a real WeChat deployment helper, but it needs Review because it weakens an upload security control and installs mutable deployment tooling while handling upload credentials.

Install only if you are comfortable with a deployment skill that can run authenticated CloudBase and Mini Program upload actions. Use a pinned CloudBase CLI version, provide only an explicit key file path, avoid disabling the upload IP whitelist unless it is temporary and documented, re-enable it immediately after upload, and keep final review/release as a manual human action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38

Finding

Mutable CloudBase CLI Dependency Is Installed Without Version Pinning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38-42
Vulnerability Type: Supply-chain exposure through an unpinned executable dependency
Risk Level: Medium

Vulnerable Code

sh

cd ~/.workbuddy/binaries/node/workspace
npm install @cloudbase/cli@latest

Technical Analysis

The deployment instructions install the mutable latest release of @cloudbase/cli. The effective code executed by this workflow can therefore change after the skill has been reviewed, without any corresponding change to this repository.

An npm installation may execute package lifecycle scripts, while subsequent deployment steps directly execute the installed CLI in an authenticated CloudBase context. If the package, one of its transitive dependencies, its publisher account, or the package registry delivery path is compromised, malicious code could execute with the operating-system privileges of the deployment user.

No lockfile, exact version, integrity validation, or provenance verification is specified. This finding does not establish that the current @cloudbase/cli package is malicious; it identifies an avoidable supply-chain trust boundary.

Attack Path

1. An attacker compromises the package publisher, a transitive dependency, or the registry delivery channel.
2. A malicious release becomes the package version identified by the latest tag.
3. The operator follows the skill and runs npm install @cloudbase/cli@latest.
4. Malicious package or lifecycle code executes under the deployment user's local account.
5. The malicious code may inspect accessible files, environment variables, npm configuration, or CloudBase authentication state.
6. When the installed CLI is used, it may also alter deployment inputs, deploy modified functions, or make unauthorized requests using the operator's authenticated session.

Impact Assessment

Successful exploitation could obtain the local privileges of the user runn ...[truncated 407 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed version, for example:

   sh

   npm install --save-exact @cloudbase/cli@3.8.1
   

2. Maintain and review a committed package.json and package-lock.json, then install using:

   sh

   npm ci --ignore-scripts
   

   If lifecycle scripts are genuinely required, review them before allowing execution rather than disabling them permanently.

3. Verify package integrity and npm provenance where available. Review the resolved package source and transitive dependency changes before upgrades.

4. Execute deployment tooling from a dedicated, minimally privileged environment with no unrelated secrets or files.

5. Use a least-privileged CloudBase deployment identity and short-lived authentication.

6. Establish an explicit upgrade process instead of automatically consuming the newest release.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:73

Finding

Deployment Guidance Recommends Disabling the Upload IP Allowlist

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 73-77
Additional Location: references/pitfalls.md, lines 61-72
Vulnerability Type: Security control weakening
Risk Level: Medium

Vulnerable Documentation

text

- **Pitfall 3 — Upload IP whitelist only accepts IPv4.** If the egress is IPv6
  (common when traffic routes through a local proxy like `127.0.0.1:xxxx`), the
  error is `errCode -10008 invalid ip: 该IPv6地址`. Whitelist UI cannot accept IPv6,
  so the only fix is to **turn off the whitelist toggle** in MP backend, or
  switch the machine to an IPv4 egress.

The detailed guidance in references/pitfalls.md similarly presents disabling the upload IP allowlist as the primary and most convenient solution.

Technical Analysis

The IP allowlist is a defense-in-depth control that limits where a valid Mini Program upload key can be used. Disabling it allows upload authentication attempts from any network location, leaving possession of the private upload key as the primary barrier.

The documented incompatibility between an IPv6 egress and an IPv4-only allowlist is operationally relevant, but disabling the control is not the only security-preserving resolution. The same text acknowledges that a controlled IPv4 egress can be used. The recommendation also lacks mandatory instructions to re-enable the allowlist after a temporary upload or rotate the key if exposure is suspected.

This weakness is not an independent authentication bypass. Exploitation still requires a valid upload key or another compromise of the upload credentials.

Attack Path

1. An operator follows the deployment guidance and disables the Mini Program upload IP allowlist.
2. The allowlist remains disabled after deployment.
3. An attacker obtains the upload private key through a separate compromise, such as workstation access, an insecure backup, accidental disclosure, or malicious dependency execution.
4. Be ...[truncated 980 chars]

Remediation

View remediation

Remediation Suggestions

1. Retain the IP allowlist and perform uploads through a controlled, stable IPv4 egress, such as a managed CI runner, VPN gateway, NAT gateway, or dedicated deployment host.
2. Add the controlled public IPv4 address to the allowlist instead of disabling the control.
3. If temporary disablement is unavoidable, document it as a time-limited exception and require immediate re-enablement after the upload.
4. Rotate the upload private key after any period in which the allowlist was disabled, especially if the key's confidentiality cannot be conclusively established.
5. Store the private key in a restricted secret store or a file readable only by the deployment identity. Do not place it in the repository, logs, shell history, or chat.
6. Use a dedicated deployment identity and preserve separate human approval for review and production release.
7. Update the guidance so disabling the allowlist is presented as a last resort rather than the preferred permanent solution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill instructs the agent to perform shell-based deployment actions and consume environment/file-based secrets, but it declares no explicit tool scope or permissions boundary. In practice, this can let the skill run with broader-than-necessary execution capability, increasing the chance of unintended command execution, file access, or secret exposure if the skill is invoked in an overprivileged agent context.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

The phrase 'Never ask the user to paste secret key contents. Read the path from disk.' pushes the agent toward autonomous handling of sensitive material from the local filesystem. Even though the stated goal is to protect secrets from chat exposure, it authorizes the agent to locate and use credential files directly, which can lead to secret misuse or overbroad file access without an explicit permission checkpoint.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

| **Subscribe template ID** | MP backend → 功能 → 订阅消息 → 我的模板 | For daily push `dailyPush` |
| **Upload private key** (`.key`) | MP backend → 开发设置 → 小程序代码上传密钥 → 生成/下载 | Required by `miniprogram-ci`. **Never paste key content into chat — use a local file path only.** |

Never ask the user to paste secret key contents. Read the path from disk.

## Deployment workflow

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document explicitly recommends turning off the mini-program upload IP allowlist as the '唯一解法' and frames the reduced security as acceptable because the upload private key remains local. Disabling an allowlist removes a meaningful network-layer access control and increases exposure if the key is mishandled, reused on less trusted hosts, or the local environment is compromised.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/pitfalls.md (reported line 156)May include surrounding context.

md

NODE=~/.workbuddy/binaries/node/versions/22.22.2/bin/node

# 2) 登录（后台跑，抓 /tmp/tcb-login.log 里的授权 URL）
nohup $NODE $TCB login |& tee /tmp/tcb-login.log &

# 3) 部署云函数
$NODE $TCB fn deploy api --force -r ap-shanghai

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The entire skill content is written only in Chinese and does not offer any language or locale choice. Under the stated policy, forcing a single language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.