wxa-skills-generate

The module is a powerful probe/automation tool that instruments wx.request to capture detailed network traffic and persists it locally. The most significant security concern is the evaluate step, which executes unvalidated plan-provided JavaScript via miniProgram.evaluate(new Function(step.code)) inside the mini-program runtime. Together with the request step (plan-controlled wx.request initiation) and full request/response logging (headers and bodies), an attacker who can influence the plan/steps could run arbitrary in-app logic and capture sensitive data for persistence. No clear OS command execution or remote exfiltration is visible in this snippet, but the capability set warrants strict control of plan inputs and output handling.