miniprogram-development
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates project operations, debugging, and deployment by executing the
wechatideandmcporterCLI tools. These tools are used for opening project windows, compiling code, and managing cloud resources. - [EXTERNAL_DOWNLOADS]: References and provides links to official WeChat Developer Tools and vendor-maintained documentation. It also suggests installing the CloudBase MCP package from a public registry.
- [REMOTE_CODE_EXECUTION]: Instructions describe fetching and running the
@cloudbase/cloudbase-mcppackage vianpxfor advanced cloud governance tasks. These resources originate from the skill's authoring vendor. - [INDIRECT_PROMPT_INJECTION]: The skill has an indirect prompt injection surface due to its core functionality of reading and acting upon project data.
- Ingestion points: Processes
project.config.json, page configuration files, and mini program source code to determine tool parameters (SKILL.md, references/devtools-debug-preview.md). - Boundary markers: Absent; the instructions do not define specific delimiters or warnings to ignore instructions embedded within the files being processed.
- Capability inventory: Executes shell commands with various flags through the
wechatideandmcportertools (references/devtools-debug-preview.md, references/cloudbase-integration.md). - Sanitization: Absent; no explicit validation or escaping of data extracted from project files is specified before it is interpolated into shell commands.
Audit Metadata