wxa-skills-generate

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The spec explicitly requires verbatim copying of authentication function/snippet bodies into auth-spec and then reusing that auth-spec when generating request code (preserving all auth headers/params), which forces the LLM to read and reproduce potentially sensitive secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 源码生成过程在阶段3.7/4读取并合并 source-miniprogram/.ai-mode-skills/probe/<run-id>.json（由 scripts/probe.mjs 在原项目运行中覆写 wx.request 捕获真实响应），其中包含开发者工具/被探测页面发出的任意外部响应文本数据。