ClawHub
Back to skill

Security audit

Uniapp Guide

Security checks for vulnerabilities and agentic risk

Overview

This is a static uni-app development guide with some copy-paste security cautions, but no hidden execution, persistence, or purpose-mismatched behavior.

Before installing or following the examples, verify the template repository name, pin package/template versions where possible, avoid running npm setup as an administrator, keep WeChat urlCheck enabled outside local debugging, and only send stored tokens to trusted API origins.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
skill.md:70
Finding

Unpinned Executable Package and Mutable Project Templates

Content
View full analysis

Vulnerability Details

File Location: skill.md:70-77
Vulnerability Type: Supply-chain exposure through unpinned packages and mutable template references
Risk Level: Medium

Vulnerable Code

bash
# Vue 3 + Vite version
npx degit dcloudio/uni-present-vue#vite my-project
cd my-project
npm install

# Vue 2 version
npx degit dcloudio/uni-preset-vue#v2 my-project-vue2
cd my-project-vue2
npm install

Technical Analysis

The guide instructs users to execute degit through npx without specifying an audited package version. Depending on the local npm configuration and cache state, npx may retrieve and execute the current package release from the npm registry.

The project templates are selected through mutable branch references (vite and v2) rather than immutable commit hashes or verified release tags. Their contents can therefore change after the Skill has been reviewed. Running npm install in the resulting projects may also execute dependency lifecycle scripts included by the downloaded template.

The first source, dcloudio/uni-present-vue#vite, differs from the later dcloudio/uni-preset-vue#v2 source. This may be a typographical error and increases the risk of retrieving an unintended repository. The audit did not establish that either current source is malicious; the vulnerability is the absence of source and version integrity controls.

Attack Path

  1. A user follows the project-creation instructions.
  2. npx downloads an unpinned release of degit when no trusted cached version is available.
  3. degit retrieves a template from a mutable repository branch, potentially including an unintended source caused by the apparent naming discrepancy.
  4. The user enters the downloaded directory and runs npm install.
  5. If the package, repository, branch, or one of the template dependencies has been compromised, attacker-controlled lifecycle code executes with the privileges of ...[truncated 568 chars]
Remediation
View remediation

Remediation Suggestions

  1. Verify and correct the apparent uni-present-vue versus uni-preset-vue repository-name discrepancy.
  2. Pin degit to a reviewed version, for example by invoking an explicitly versioned package rather than the latest available release.
  3. Pin each template to an immutable, reviewed commit hash instead of a mutable branch.
  4. Use only template sources listed in the official uni-app documentation and provide the expected repository URL.
  5. Include and preserve a reviewed lockfile, then use deterministic installation such as npm ci.
  6. Enable lockfile integrity verification and dependency scanning in CI.
  7. Review dependency lifecycle scripts before installation. Where compatible with the project, initially install with lifecycle scripts disabled and explicitly permit only required scripts.
  8. Avoid running project setup or dependency installation with administrator or root privileges.

T09 · Insecure Skill Coding Practices

Note
Location
skill.md:167
Finding

WeChat Request-Domain Validation Disabled in Example Configuration

Content
View full analysis

Vulnerability Details

File Location: skill.md:167
Vulnerability Type: Unsafe platform security configuration
Risk Level: Low

Vulnerable Code

json
"urlCheck": false

Technical Analysis

The example disables WeChat Mini Program request-domain validation without explaining that this should be restricted to local development. Domain validation provides a security boundary that helps prevent code from communicating with endpoints outside the application's approved domain configuration.

Because the setting appears in the guide's primary manifest.json example, users may copy it without recognizing its security implications. The setting is not required for the guide's declared cross-platform development functionality and therefore exceeds the minimum secure configuration needed for a general example.

Attack Path

  1. A developer copies the example configuration into a project.
  2. The disabled validation setting remains active during development or is propagated into release-related configuration.
  3. Erroneous, compromised, or malicious application code issues requests to an endpoint that is not part of the intended domain allowlist.
  4. Platform-side domain checking no longer blocks the request in an environment where this option is honored.
  5. Application data or authentication material could consequently be transmitted to an unintended endpoint.

Impact Assessment

This setting does not itself create an attacker-controlled endpoint or directly exfiltrate data. Exploitation requires another defect or malicious code capable of selecting an unauthorized destination.

If combined with such a defect, it can weaken network egress restrictions and expose data available to the affected Mini Program, including API responses, user-provided content, or authentication tokens accessible to its client code. It does not grant operating-system privileges or independently bypass server-side authorization ...[truncated 1 chars]

Remediation
View remediation

Remediation Suggestions

  1. Set urlCheck to true in the default example or omit the override so the platform's secure default applies.
  2. If disabling validation is necessary for local debugging, place the setting in a development-only configuration and clearly label it as unsafe for production.
  3. Add a build or CI check that rejects release configurations containing "urlCheck": false.
  4. Configure an explicit allowlist of approved HTTPS API domains through the platform's normal domain-management controls.
  5. Document that authentication tokens must only be sent to trusted, authenticated origins and should never be forwarded to caller-controlled URLs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill includes a reusable request wrapper that automatically attaches a stored token to every request and sends data to a remote API, but it does not instruct the agent to obtain user confirmation or clearly warn about credential use and outbound data transmission. In an agent-assisted context, this normalization of authenticated network behavior can make it easier to produce code patterns that over-send credentials or sensitive data without adequate caution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

该段仅说明“当用户询问 uni-app 相关问题时”即可提供指导，但没有限定具体触发短语、适用范围或排除条件。这样的描述覆盖面过大，容易与日常开发问答重叠，导致技能被过度或非预期调用。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.