wxmini-security-audit — Skillopedia

wxmini-security-audit Skill by ara.so — Security Skills collection. Automated security auditing framework for WeChat mini-programs using Claude Code Agent Teams. Orchestrates 7 specialized agents to perform comprehensive static analysis covering sensitive information leakage, API endpoint extraction, cryptographic analysis, and vulnerability detection across seven security dimensions. What It Does - Multi-Agent Orchestration : Coordinates 7 specialized agents (decompiler, secret scanner, endpoint miner, crypto analyzer, vulnerability analyzer, custom analyzer, reporter) - Dual-Layer Architect…

|| exit 1\n```\n\n### Bulk Analysis\n\nProcess multiple mini-programs:\n\n```bash\nfor dir in ./mini-programs/*/; do\n claude-code execute-skill wxmini-security-audit \"Audit $dir\"\n mv wxaudit-output \"results/$(basename $dir)-audit\"\ndone\n```","attachment_filenames":[],"attachments":[],"content_json":{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"wxmini-security-audit","type":"text"}]},{"type":"blockquote","content":[{"type":"paragraph","content":[{"text":"Skill by ","type":"text"},{"text":"ara.so","type":"text","marks":[{"type":"link","attrs":{"href":"https://ara.so","title":null}}]},{"text":" — Security Skills collection.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"Automated security auditing framework for WeChat mini-programs using Claude Code Agent Teams. Orchestrates 7 specialized agents to perform comprehensive static analysis covering sensitive information leakage, API endpoint extraction, cryptographic analysis, and vulnerability detection across seven security dimensions.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"What It Does","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Multi-Agent Orchestration","type":"text","marks":[{"type":"strong"}]},{"text":": Coordinates 7 specialized agents (decompiler, secret scanner, endpoint miner, crypto analyzer, vulnerability analyzer, custom analyzer, reporter)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Dual-Layer Architecture","type":"text","marks":[{"type":"strong"}]},{"text":": Python regex scripts ensure 100% rule coverage, LLM agents provide intelligent analysis with context awareness","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Parallel Phase 2 Execution","type":"text","marks":[{"type":"strong"}]},{"text":": Runs 4 analysis agents simultaneously to minimize audit time","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"User Intent Parsing","type":"text","marks":[{"type":"strong"}]},{"text":": Automatically triggers deep custom analysis when specific endpoints/parameters are mentioned","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Pure Static Analysis","type":"text","marks":[{"type":"strong"}]},{"text":": Zero network requests, no attack code generation, fully local processing","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Comprehensive Reporting","type":"text","marks":[{"type":"strong"}]},{"text":": Generates both summary reports and detailed documentation with structured data exports","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Architecture","type":"text"}]},{"type":"paragraph","content":[{"text":"The framework operates in sequential phases:","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Phase 0","type":"text","marks":[{"type":"strong"}]},{"text":": User intent parsing (extracts target path, creates output directory, parses requirements)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Phase 1","type":"text","marks":[{"type":"strong"}]},{"text":": Decompilation (unveilr.exe processes wxapkg files, generates file inventory)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Phase 1.5","type":"text","marks":[{"type":"strong"}]},{"text":": Script pre-scanning (Python regex extracts raw endpoints and secrets)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Phase 2","type":"text","marks":[{"type":"strong"}]},{"text":": Parallel analysis (4 agents run simultaneously: SecretScanner, EndpointMiner, CryptoAnalyzer, VulnAnalyzer)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Phase 2.5","type":"text","marks":[{"type":"strong"}]},{"text":": Custom analysis (triggered only when user specifies particular endpoints/parameters)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Phase 3","type":"text","marks":[{"type":"strong"}]},{"text":": Report generation (aggregates findings into structured reports)","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Installation","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Prerequisites","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Claude Code CLI environment with Agent Teams/Skill support","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Python 3.x (standard library only, no external dependencies)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Windows platform (current version requires unveilr.exe)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"unveilr.exe binary (WeChat mini-program decompiler)","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Setup","type":"text"}]},{"type":"paragraph","content":[{"text":"Clone the repository into your Claude Code Skills directory:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"git clone https://github.com/sssmmmwww/wxmini-security-audit.git\ncd wxmini-security-audit","type":"text"}]},{"type":"paragraph","content":[{"text":"Obtain ","type":"text"},{"text":"unveilr.exe","type":"text","marks":[{"type":"code_inline"}]},{"text":" from the ","type":"text"},{"text":"unveilr project","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nicholaschan23/unveilr","title":null}}]},{"text":" and place it in the ","type":"text"},{"text":"tools/","type":"text","marks":[{"type":"code_inline"}]},{"text":" directory:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"wxmini-security-audit/\n├── SKILL.md\n├── agents/\n│ ├── agent-01-decompiler.md\n│ ├── agent-02-secret-scanner.md\n│ ├── agent-03-endpoint-miner.md\n│ ├── agent-04-crypto-analyzer.md\n│ ├── agent-05-vuln-analyzer.md\n│ ├── agent-06-reporter.md\n│ └── agent-07-custom-analyzer.md\n└── tools/\n ├── unveilr.exe # Place here\n └── scripts/\n ├── endpoint_extractor.py\n └── secret_scanner.py","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Usage","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Basic Audit","type":"text"}]},{"type":"paragraph","content":[{"text":"Trigger the audit by providing a mini-program directory path:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"Audit this WeChat mini program D:\\wechat\\miniapp\\wxapkg_files","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"Analyze this mini program for security issues C:\\miniprogram\\target","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Focused Analysis","type":"text"}]},{"type":"paragraph","content":[{"text":"Specify particular concerns to trigger Phase 2.5 custom analysis:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"Audit this mini program D:\\wxapp, focus on the /api/user/login endpoint","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"Scan D:\\wxapp for vulnerabilities, particularly payment security and privilege escalation","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"With External Tool Integration","type":"text"}]},{"type":"paragraph","content":[{"text":"Provide context from intercepting proxies:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"Analyze this mini program D:\\wxapp, Burp Suite captured the /api/pay endpoint with a tamperable amount parameter","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Output Structure","type":"text"}]},{"type":"paragraph","content":[{"text":"After completion, find results in ","type":"text"},{"text":"wxaudit-output/","type":"text","marks":[{"type":"code_inline"}]},{"text":":","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"wxaudit-output/\n├── security_report.md # Primary findings, risk assessment, remediation\n├── api_endpoints_full.md # Complete endpoint inventory\n├── secrets_full.md # All sensitive findings including false positives\n├── findings.json # Structured summary data\n├── domains.txt # Extracted domain list\n├── endpoints_fuzz.txt # Fuzzing-ready endpoint list\n├── file_inventory.json # Decompiled file asset manifest\n├── raw_endpoints.json # Regex extraction raw results\n├── raw_secrets.json # Secret scanner raw results\n├── secrets_report.json # Intelligent secret analysis\n├── api_endpoints.json # Intelligent API analysis\n├── crypto_analysis.json # Cryptographic assessment\n├── vuln_analysis.json # Vulnerability findings\n└── custom_analysis.json # Custom requirement analysis (conditional)","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Python Script Layer","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Endpoint Extraction Script","type":"text"}]},{"type":"paragraph","content":[{"text":"Located at ","type":"text"},{"text":"tools/scripts/endpoint_extractor.py","type":"text","marks":[{"type":"code_inline"}]},{"text":", this script provides 100% rule coverage for API endpoint detection:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"import re\nimport json\nimport os\n\ndef extract_endpoints(source_dir):\n \"\"\"\n Extract API endpoints from decompiled mini-program files.\n Returns: List of dicts with {pattern, file, line, context}\n \"\"\"\n endpoints = []\n patterns = [\n r'https?://[^\\s\\'\"]+', # Full URLs\n r'wx\\.request\\s*\\(\\s*\\{[^}]+url\\s*:\\s*[\\'\"]([^\\'\"]+)',\n r'url\\s*:\\s*[\\'\"]([^\\'\"]+)[\\'\"]', # Generic URL assignments\n r'/api/[a-zA-Z0-9/_-]+', # API path fragments\n r'baseURL\\s*:\\s*[\\'\"]([^\\'\"]+)[\\'\"]', # Base URL configs\n ]\n \n for root, dirs, files in os.walk(source_dir):\n for file in files:\n if not file.endswith(('.js', '.json')):\n continue\n \n filepath = os.path.join(root, file)\n try:\n with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:\n for line_num, line in enumerate(f, 1):\n for pattern in patterns:\n for match in re.finditer(pattern, line):\n endpoints.append({\n 'pattern': pattern,\n 'value': match.group(0),\n 'file': filepath,\n 'line': line_num,\n 'context': line.strip()\n })\n except Exception as e:\n continue\n \n return endpoints\n\nif __name__ == '__main__':\n import sys\n source_dir = sys.argv[1]\n output_file = sys.argv[2]\n \n results = extract_endpoints(source_dir)\n with open(output_file, 'w', encoding='utf-8') as f:\n json.dump(results, f, indent=2, ensure_ascii=False)","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Secret Scanner Script","type":"text"}]},{"type":"paragraph","content":[{"text":"Located at ","type":"text"},{"text":"tools/scripts/secret_scanner.py","type":"text","marks":[{"type":"code_inline"}]},{"text":":","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"import re\nimport json\nimport os\n\nSECRET_PATTERNS = {\n 'api_key': r'(?i)(api[_-]?key|apikey|key)\\s*[:=]\\s*[\\'\"]([a-zA-Z0-9_\\-]{16,})[\\'\"]',\n 'access_token': r'(?i)(access[_-]?token|accesstoken)\\s*[:=]\\s*[\\'\"]([a-zA-Z0-9_\\-\\.]{20,})[\\'\"]',\n 'secret': r'(?i)(secret|app[_-]?secret)\\s*[:=]\\s*[\\'\"]([a-zA-Z0-9_\\-]{16,})[\\'\"]',\n 'password': r'(?i)(password|passwd|pwd)\\s*[:=]\\s*[\\'\"](.{6,})[\\'\"]',\n 'private_key': r'-----BEGIN\\s+(?:RSA\\s+)?PRIVATE\\s+KEY-----',\n 'ip_internal': r'\\b(?:10|172\\.(?:1[6-9]|2[0-9]|3[01])|192\\.168)\\.\\d{1,3}\\.\\d{1,3}\\b',\n 'phone': r'(?\u003c![0-9])(1[3-9]\\d{9})(?![0-9])',\n 'id_card': r'[1-6]\\d{5}(?:19|20)\\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\\d|3[01])\\d{3}[\\dXx]',\n 'email': r'\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\\b',\n 'debug_flag': r'(?i)(debug|test|dev)[_-]?(mode|flag|env)\\s*[:=]\\s*(true|1|yes)',\n}\n\ndef scan_secrets(source_dir):\n \"\"\"\n Scan for sensitive information in source files.\n Returns: List of findings with {type, value, file, line, context}\n \"\"\"\n findings = []\n \n for root, dirs, files in os.walk(source_dir):\n for file in files:\n if not file.endswith(('.js', '.json', '.xml')):\n continue\n \n filepath = os.path.join(root, file)\n try:\n with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:\n for line_num, line in enumerate(f, 1):\n for secret_type, pattern in SECRET_PATTERNS.items():\n for match in re.finditer(pattern, line):\n findings.append({\n 'type': secret_type,\n 'value': match.group(0),\n 'file': filepath,\n 'line': line_num,\n 'context': line.strip(),\n 'severity': classify_severity(secret_type)\n })\n except Exception as e:\n continue\n \n return findings\n\ndef classify_severity(secret_type):\n \"\"\"Assign severity based on secret type.\"\"\"\n critical = ['private_key', 'secret', 'api_key']\n high = ['access_token', 'password']\n medium = ['ip_internal', 'debug_flag']\n \n if secret_type in critical:\n return 'CRITICAL'\n elif secret_type in high:\n return 'HIGH'\n elif secret_type in medium:\n return 'MEDIUM'\n return 'LOW'\n\nif __name__ == '__main__':\n import sys\n source_dir = sys.argv[1]\n output_file = sys.argv[2]\n \n results = scan_secrets(source_dir)\n with open(output_file, 'w', encoding='utf-8') as f:\n json.dump(results, f, indent=2, ensure_ascii=False)","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Agent Configuration","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Agent 02: SecretScanner","type":"text"}]},{"type":"paragraph","content":[{"text":"Receives ","type":"text"},{"text":"raw_secrets.json","type":"text","marks":[{"type":"code_inline"}]},{"text":" from the script layer and performs intelligent filtering:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"markdown"},"content":[{"text":"# Role\nYou are a security analyst specializing in sensitive information leakage detection.\n\n# Input\n- file_inventory.json (file asset manifest)\n- raw_secrets.json (script extraction results)\n\n# Task\n1. Load raw_secrets.json\n2. Filter false positives:\n - Placeholder values (e.g., \"YOUR_API_KEY\", \"example.com\")\n - Comments and documentation\n - Test/demo code markers\n3. Classify real findings by severity\n4. Generate contextual risk assessment\n\n# Output Format\nsecrets_report.json:\n{\n \"valid_findings\": [\n {\n \"type\": \"api_key\",\n \"value\": \"[REDACTED]\",\n \"file\": \"pages/user/login.js\",\n \"line\": 42,\n \"severity\": \"CRITICAL\",\n \"reasoning\": \"Hardcoded API key in production login flow\",\n \"recommendation\": \"Move to secure backend configuration\"\n }\n ],\n \"false_positives\": [...],\n \"summary\": {\n \"total_raw\": 156,\n \"valid\": 23,\n \"critical\": 3,\n \"high\": 8,\n \"medium\": 12\n }\n}","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Agent 03: EndpointMiner","type":"text"}]},{"type":"paragraph","content":[{"text":"Correlates endpoint fragments with BaseURL configurations:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"markdown"},"content":[{"text":"# Role\nAPI endpoint extraction and intelligent correlation specialist.\n\n# Input\n- file_inventory.json\n- raw_endpoints.json (script results)\n\n# Task\n1. Group endpoints by BaseURL\n2. Reconstruct complete API URLs from fragments\n3. Identify request methods from wx.request contexts\n4. Map endpoints to source files\n5. Flag suspicious patterns (internal IPs, non-HTTPS, hardcoded credentials in URLs)\n\n# Output Format\napi_endpoints.json:\n{\n \"domains\": [\"https://api.example.com\", \"https://backend.example.com\"],\n \"endpoints\": [\n {\n \"method\": \"POST\",\n \"url\": \"https://api.example.com/api/user/login\",\n \"base\": \"https://api.example.com\",\n \"path\": \"/api/user/login\",\n \"source_file\": \"utils/request.js\",\n \"line\": 15,\n \"params\": [\"username\", \"password\"],\n \"security_notes\": [\"Uses HTTPS\", \"No credential exposure\"]\n }\n ]\n}","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Agent 05: VulnAnalyzer","type":"text"}]},{"type":"paragraph","content":[{"text":"Performs vulnerability analysis across seven dimensions:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"markdown"},"content":[{"text":"# Vulnerability Analysis Dimensions\n\n1. **Authentication & Authorization**\n - Token storage in localStorage\n - Session management flaws\n - Missing authentication checks\n\n2. **Data Security**\n - Sensitive data in logs\n - Unencrypted storage\n - PII exposure\n\n3. **Injection Vulnerabilities**\n - SQL injection vectors\n - XSS potential\n - Command injection\n\n4. **Privilege Escalation**\n - Role-based access control bypasses\n - User ID manipulation risks\n\n5. **Payment Security**\n - Amount tampering potential\n - Order verification gaps\n\n6. **Information Leakage**\n - Error messages exposing internals\n - Debug mode in production\n - Version disclosure\n\n7. **Configuration Security**\n - Insecure default settings\n - Missing security headers\n - Weak encryption algorithms\n\n# Output Format\nvuln_analysis.json with findings categorized by dimension and severity.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Common Patterns","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Pattern 1: Basic Directory Audit","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"User: Audit this WeChat mini program D:\\projects\\wxapp\nAgent: [Executes full 6-phase pipeline]\nOutput: wxaudit-output/ with 14 files","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Pattern 2: Targeted Endpoint Analysis","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"User: Analyze D:\\wxapp, focus on /api/payment/submit\nAgent: [Triggers Phase 2.5 CustomAnalyzer]\nOutput: Includes custom_analysis.json with deep dive on payment endpoint","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Pattern 3: Integration with Burp Suite","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"User: Audit D:\\wxapp, Burp found /api/user/profile returns other users' data when changing uid parameter\nAgent: [Correlates with extracted endpoints, flags in vuln_analysis.json under \"Privilege Escalation\"]","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Troubleshooting","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Issue: \"unveilr.exe not found\"","type":"text"}]},{"type":"paragraph","content":[{"text":"Solution","type":"text","marks":[{"type":"strong"}]},{"text":": Download unveilr.exe and place in ","type":"text"},{"text":"tools/","type":"text","marks":[{"type":"code_inline"}]},{"text":" directory:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Verify placement\nls tools/unveilr.exe\n# Should show: tools/unveilr.exe","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Issue: \"No endpoints found in raw_endpoints.json\"","type":"text"}]},{"type":"paragraph","content":[{"text":"Cause","type":"text","marks":[{"type":"strong"}]},{"text":": Source directory contains only compiled wxapkg files, not decompiled JS.","type":"text"}]},{"type":"paragraph","content":[{"text":"Solution","type":"text","marks":[{"type":"strong"}]},{"text":": Ensure Phase 1 (agent-01-decompiler) completes successfully. Check ","type":"text"},{"text":"file_inventory.json","type":"text","marks":[{"type":"code_inline"}]},{"text":" for .js files:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"cat wxaudit-output/file_inventory.json | grep \".js\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Issue: \"High false positive rate in secrets_full.md\"","type":"text"}]},{"type":"paragraph","content":[{"text":"Expected","type":"text","marks":[{"type":"strong"}]},{"text":": The dual-layer architecture intentionally preserves all script findings. Agent-02 filters these in ","type":"text"},{"text":"secrets_report.json","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Check","type":"text","marks":[{"type":"strong"}]},{"text":": Review ","type":"text"},{"text":"secrets_report.json","type":"text","marks":[{"type":"code_inline"}]},{"text":" for filtered valid findings:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"cat wxaudit-output/secrets_report.json | jq '.summary'","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Issue: \"Custom analysis not triggered\"","type":"text"}]},{"type":"paragraph","content":[{"text":"Cause","type":"text","marks":[{"type":"strong"}]},{"text":": User prompt did not specify particular endpoints/parameters.","type":"text"}]},{"type":"paragraph","content":[{"text":"Solution","type":"text","marks":[{"type":"strong"}]},{"text":": Explicitly mention target areas:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"Analyze D:\\wxapp, investigate the /api/order/create endpoint and its amount parameter","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Issue: \"Script execution errors in Phase 1.5\"","type":"text"}]},{"type":"paragraph","content":[{"text":"Debug","type":"text","marks":[{"type":"strong"}]},{"text":": Check Python script output directly:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"python tools/scripts/endpoint_extractor.py D:\\decompiled_output wxaudit-output/raw_endpoints.json\npython tools/scripts/secret_scanner.py D:\\decompiled_output wxaudit-output/raw_secrets.json","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Security Constraints","type":"text"}]},{"type":"paragraph","content":[{"text":"This framework adheres to strict ethical boundaries:","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"No Network Activity","type":"text","marks":[{"type":"strong"}]},{"text":": All analysis is local; no validation of extracted secrets/tokens","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"No Attack Code","type":"text","marks":[{"type":"strong"}]},{"text":": Does not generate PoC exploits or automated attack scripts","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Minimal Permissions","type":"text","marks":[{"type":"strong"}]},{"text":": Read-only access to source directory, write-only to output directory","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Data Privacy","type":"text","marks":[{"type":"strong"}]},{"text":": No telemetry, no external uploads, all processing remains local","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Environment Variables","type":"text"}]},{"type":"paragraph","content":[{"text":"No environment variables required. All configuration is embedded in agent prompt files under ","type":"text"},{"text":"agents/","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"To customize agent behavior, edit the respective ","type":"text"},{"text":".md","type":"text","marks":[{"type":"code_inline"}]},{"text":" files:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Example: Adjust SecretScanner sensitivity\nvim agents/agent-02-secret-scanner.md\n# Modify the false positive filtering rules section","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Advanced Usage","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Custom Vulnerability Rules","type":"text"}]},{"type":"paragraph","content":[{"text":"Extend ","type":"text"},{"text":"agent-05-vuln-analyzer.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" with project-specific patterns:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"markdown"},"content":[{"text":"# Custom Rules (add to agent-05-vuln-analyzer.md)\n\n8. **Business Logic Flaws**\n - Check for discount code stacking vulnerabilities\n - Verify coupon expiration enforcement\n - Validate inventory deduction timing","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Integration with CI/CD","type":"text"}]},{"type":"paragraph","content":[{"text":"Run as part of security pipeline:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Example GitLab CI job\nsecurity_audit:\n script:\n - claude-code execute-skill wxmini-security-audit \"Audit ./decompiled_app\"\n - cat wxaudit-output/findings.json | jq '.summary.critical' | grep -q '^0

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

|| exit 1","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Bulk Analysis","type":"text"}]},{"type":"paragraph","content":[{"text":"Process multiple mini-programs:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"for dir in ./mini-programs/*/; do\n claude-code execute-skill wxmini-security-audit \"Audit $dir\"\n mv wxaudit-output \"results/$(basename $dir)-audit\"\ndone","type":"text"}]}]},"metadata":{"date":"2026-11-02","name":"wxmini-security-audit","author":"@skillopedia","source":{"stars":12,"repo_name":"security-skills","origin_url":"https://github.com/reason-machines/security-skills/blob/HEAD/skills/wxmini-security-audit/SKILL.md","repo_owner":"reason-machines","body_sha256":"2d0721f99f3520af4c1bceed7b4bd39f9f0f23e0f159443676d0b810255c936f","cluster_key":"0096fe1e4c072d2ba1759f9272f4ae3936104d8789619cbd9a5e2606be679bcb","clean_bundle":{"format":"clean-skill-bundle-v1","source":"reason-machines/security-skills/skills/wxmini-security-audit/SKILL.md","text_bytes":0,"source_commit":"1722e18788818fff1b0144132437936c2095971c","skills_sh_rank":12498,"attachment_count":0,"text_attachments":0,"attachment_storage":"skill_attachments","binary_attachments":0},"cluster_size":1,"skill_md_path":"skills/wxmini-security-audit/SKILL.md","import_metadata":{"date":"2026-11-02","author":"@skillopedia","version":"v1","category":"security","category_label":"Security"},"exact_dupes_collapsed_into_this":0},"version":"v1","category":"security","triggers":["audit this WeChat mini program","analyze this wxapkg directory for security issues","scan this mini program for vulnerabilities","perform security audit on WeChat app","check this WeChat mini program for sensitive data leaks","review this wxapkg for API security issues","run wxmini security analysis on this directory","decompile and audit this WeChat mini program"],"import_tag":"skills-sh-top20k-2026-11","description":"Automated WeChat mini-program security auditing framework using Claude Code Agent Teams with 7 specialized agents for comprehensive static analysis"}},"renderedAt":1793671580999}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.