# wxmini-security-audit

This skill inspects decompiled wxapkg bundles for leaked secrets, API endpoints, weak crypto and vulnerabilities. Run it before shipping a mini-program.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1100 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/wxmini-security-audit/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/wxmini-security-audit

## What it does

Seven Claude Agent Teams agents do the work: a decompiler, a secret scanner, an endpoint miner, a crypto analyzer, a vulnerability analyzer, a custom analyzer and a reporter. The run moves through phases — intent parsing, decompilation, a script pre-scan, four analyzers in parallel, then report generation. Name a specific endpoint or parameter and an extra custom-analysis phase kicks in for it.

Two layers sit behind that. Python scripts `endpoint_extractor.py` and `secret_scanner.py` walk `.js` and `.json` files with regexes to catch raw matches, and the LLM agents judge those matches against their context. Nothing leaves the machine: no network calls, no exploit code.

Windows is required right now, because the current version depends on `unveilr.exe`. Drop that decompiler binary into `tools/` — without it the decompilation phase will not run. Python 3.x is enough, standard library only. Findings land in `wxaudit-output/` as `security_report.md`, `findings.json`, `endpoints_fuzz.txt` and several JSON files covering endpoints, secrets and crypto.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill wxmini-security-audit -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/wxmini-security-audit/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/wxmini-security-audit/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill wxmini-security-audit -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/wxmini-security-audit/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill wxmini-security-audit -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/wxmini-security-audit/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills wxmini-security-audit
```

2. **Manually: put the files in place**
- File: `.github/skills/wxmini-security-audit/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill wxmini-security-audit -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/wxmini-security-audit
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/wxmini-security-audit/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill wxmini-security-audit -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/wxmini-security-audit/SKILL.md

## When to use it
- find leaked keys and tokens in a decompiled wxapkg
- collect API endpoints worth testing further
- assess how a mini-program encrypts its data
- dig into one endpoint such as `/api/user/login`
- turn findings into a report with risk notes

## Example prompts
- Audit this WeChat mini program `D:\wechat\miniapp\wxapkg_files`
- Scan `D:\wxapp` for vulnerabilities, especially payment security and privilege escalation
- Analyze `D:\wxapp`, Burp Suite captured `/api/pay` with a tamperable amount parameter

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 24 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md