wxmini-security-audit — Claude Code skill: WeChat mini-program audit
This skill inspects decompiled wxapkg bundles for leaked secrets, API endpoints, weak crypto and vulnerabilities. Run it before shipping a mini-program.
npx skills add reason-machines/security-skills --skill wxmini-security-audit -a claude-codeWhat wxmini-security-audit does
Seven Claude Agent Teams agents do the work: a decompiler, a secret scanner, an endpoint miner, a crypto analyzer, a vulnerability analyzer, a custom analyzer and a reporter. The run moves through phases — intent parsing, decompilation, a script pre-scan, four analyzers in parallel, then report generation. Name a specific endpoint or parameter and an extra custom-analysis phase kicks in for it.
Two layers sit behind that. Python scripts endpoint_extractor.py and secret_scanner.py walk .js and .json files with regexes to catch raw matches, and the LLM agents judge those matches against their context. Nothing leaves the machine: no network calls, no exploit code.
Windows is required right now, because the current version depends on unveilr.exe. Drop that decompiler binary into tools/ — without it the decompilation phase will not run. Python 3.x is enough, standard library only. Findings land in wxaudit-output/ as security_report.md, findings.json, endpoints_fuzz.txt and several JSON files covering endpoints, secrets and crypto.
What it helps with
- find leaked keys and tokens in a decompiled wxapkg
- collect API endpoints worth testing further
- assess how a mini-program encrypts its data
- dig into one endpoint such as
/api/user/login - turn findings into a report with risk notes
Example prompts for the agent
- Audit this WeChat mini program
D:\wechat\miniapp\wxapkg_files - Scan
D:\wxappfor vulnerabilities, especially payment security and privilege escalation - Analyze
D:\wxapp, Burp Suite captured/api/paywith a tamperable amount parameter
How to install wxmini-security-audit
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill wxmini-security-audit -a claude-code2Manually: put the files in place
~/.claude/skills/wxmini-security-audit/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/wxmini-security-audit/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill wxmini-security-audit -a codex2Manually: put the files in place
.agents/skills/wxmini-security-audit/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill wxmini-security-audit -a cursor2Manually: put the files in place
.cursor/skills/wxmini-security-audit/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install reason-machines/security-skills wxmini-security-audit2Manually: put the files in place
.github/skills/wxmini-security-audit/SKILL.md1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill wxmini-security-audit -a gemini-cli2Platform CLI
gemini skills install https://github.com/reason-machines/security-skills --path skills/wxmini-security-auditManually: put the files in place
.devin/skills/wxmini-security-audit/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill wxmini-security-audit -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about wxmini-security-audit
How do I install wxmini-security-audit in Claude Code?
Run npx skills add reason-machines/security-skills --skill wxmini-security-audit -a claude-code. The skill ends up at ~/.claude/skills/wxmini-security-audit/SKILL.md.
What does wxmini-security-audit do?
It statically audits WeChat mini-programs for secrets, endpoints, crypto problems and vulnerabilities, then writes reports into wxaudit-output/.
What do I need before running it?
Windows, Python 3.x and the unveilr.exe binary inside tools/. Decompilation of wxapkg files fails without it.
