miniprogram-development

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates project operations, debugging, and deployment by executing the wechatide and mcporter CLI tools. These tools are used for opening project windows, compiling code, and managing cloud resources.
  • [EXTERNAL_DOWNLOADS]: References and provides links to official WeChat Developer Tools and vendor-maintained documentation. It also suggests installing the CloudBase MCP package from a public registry.
  • [REMOTE_CODE_EXECUTION]: Instructions describe fetching and running the @cloudbase/cloudbase-mcp package via npx for advanced cloud governance tasks. These resources originate from the skill's authoring vendor.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an indirect prompt injection surface due to its core functionality of reading and acting upon project data.
  • Ingestion points: Processes project.config.json, page configuration files, and mini program source code to determine tool parameters (SKILL.md, references/devtools-debug-preview.md).
  • Boundary markers: Absent; the instructions do not define specific delimiters or warnings to ignore instructions embedded within the files being processed.
  • Capability inventory: Executes shell commands with various flags through the wechatide and mcporter tools (references/devtools-debug-preview.md, references/cloudbase-integration.md).
  • Sanitization: Absent; no explicit validation or escaping of data extracted from project files is specified before it is interpolated into shell commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 05:34 PM
Security Audit — agent-trust-hub — miniprogram-development