git clone https://github.com/sssmmmwww/wxmini-security-audit.git
cd wxmini-security-audit

wxmini-security-audit/
├── SKILL.md
├── agents/
│   ├── agent-01-decompiler.md
│   ├── agent-02-secret-scanner.md
│   ├── agent-03-endpoint-miner.md
│   ├── agent-04-crypto-analyzer.md
│   ├── agent-05-vuln-analyzer.md
│   ├── agent-06-reporter.md
│   └── agent-07-custom-analyzer.md
└── tools/
    ├── unveilr.exe          # Place here
    └── scripts/
        ├── endpoint_extractor.py
        └── secret_scanner.py

Audit this WeChat mini program D:\wechat\miniapp\wxapkg_files

Analyze this mini program for security issues C:\miniprogram\target

Audit this mini program D:\wxapp, focus on the /api/user/login endpoint

Scan D:\wxapp for vulnerabilities, particularly payment security and privilege escalation

Analyze this mini program D:\wxapp, Burp Suite captured the /api/pay endpoint with a tamperable amount parameter

wxaudit-output/
├── security_report.md          # Primary findings, risk assessment, remediation
├── api_endpoints_full.md       # Complete endpoint inventory
├── secrets_full.md             # All sensitive findings including false positives
├── findings.json               # Structured summary data
├── domains.txt                 # Extracted domain list
├── endpoints_fuzz.txt          # Fuzzing-ready endpoint list
├── file_inventory.json         # Decompiled file asset manifest
├── raw_endpoints.json          # Regex extraction raw results
├── raw_secrets.json            # Secret scanner raw results
├── secrets_report.json         # Intelligent secret analysis
├── api_endpoints.json          # Intelligent API analysis
├── crypto_analysis.json        # Cryptographic assessment
├── vuln_analysis.json          # Vulnerability findings
└── custom_analysis.json        # Custom requirement analysis (conditional)

import re
import json
import os

def extract_endpoints(source_dir):
    """
    Extract API endpoints from decompiled mini-program files.
    Returns: List of dicts with {pattern, file, line, context}
    """
    endpoints = []
    patterns = [
        r'https?://[^\s\'"]+',                    # Full URLs
        r'wx\.request\s*\(\s*\{[^}]+url\s*:\s*[\'"]([^\'"]+)',
        r'url\s*:\s*[\'"]([^\'"]+)[\'"]',         # Generic URL assignments
        r'/api/[a-zA-Z0-9/_-]+',                  # API path fragments
        r'baseURL\s*:\s*[\'"]([^\'"]+)[\'"]',     # Base URL configs
    ]
    
    for root, dirs, files in os.walk(source_dir):
        for file in files:
            if not file.endswith(('.js', '.json')):
                continue
            
            filepath = os.path.join(root, file)
            try:
                with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
                    for line_num, line in enumerate(f, 1):
                        for pattern in patterns:
                            for match in re.finditer(pattern, line):
                                endpoints.append({
                                    'pattern': pattern,
                                    'value': match.group(0),
                                    'file': filepath,
                                    'line': line_num,
                                    'context': line.strip()
                                })
            except Exception as e:
                continue
    
    return endpoints

if __name__ == '__main__':
    import sys
    source_dir = sys.argv[1]
    output_file = sys.argv[2]
    
    results = extract_endpoints(source_dir)
    with open(output_file, 'w', encoding='utf-8') as f:
        json.dump(results, f, indent=2, ensure_ascii=False)

import re
import json
import os

SECRET_PATTERNS = {
    'api_key': r'(?i)(api[_-]?key|apikey|key)\s*[:=]\s*[\'"]([a-zA-Z0-9_\-]{16,})[\'"]',
    'access_token': r'(?i)(access[_-]?token|accesstoken)\s*[:=]\s*[\'"]([a-zA-Z0-9_\-\.]{20,})[\'"]',
    'secret': r'(?i)(secret|app[_-]?secret)\s*[:=]\s*[\'"]([a-zA-Z0-9_\-]{16,})[\'"]',
    'password': r'(?i)(password|passwd|pwd)\s*[:=]\s*[\'"](.{6,})[\'"]',
    'private_key': r'-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----',
    'ip_internal': r'\b(?:10|172\.(?:1[6-9]|2[0-9]|3[01])|192\.168)\.\d{1,3}\.\d{1,3}\b',
    'phone': r'(?<![0-9])(1[3-9]\d{9})(?![0-9])',
    'id_card': r'[1-6]\d{5}(?:19|20)\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])\d{3}[\dXx]',
    'email': r'\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b',
    'debug_flag': r'(?i)(debug|test|dev)[_-]?(mode|flag|env)\s*[:=]\s*(true|1|yes)',
}

def scan_secrets(source_dir):
    """
    Scan for sensitive information in source files.
    Returns: List of findings with {type, value, file, line, context}
    """
    findings = []
    
    for root, dirs, files in os.walk(source_dir):
        for file in files:
            if not file.endswith(('.js', '.json', '.xml')):
                continue
            
            filepath = os.path.join(root, file)
            try:
                with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
                    for line_num, line in enumerate(f, 1):
                        for secret_type, pattern in SECRET_PATTERNS.items():
                            for match in re.finditer(pattern, line):
                                findings.append({
                                    'type': secret_type,
                                    'value': match.group(0),
                                    'file': filepath,
                                    'line': line_num,
                                    'context': line.strip(),
                                    'severity': classify_severity(secret_type)
                                })
            except Exception as e:
                continue
    
    return findings

def classify_severity(secret_type):
    """Assign severity based on secret type."""
    critical = ['private_key', 'secret', 'api_key']
    high = ['access_token', 'password']
    medium = ['ip_internal', 'debug_flag']
    
    if secret_type in critical:
        return 'CRITICAL'
    elif secret_type in high:
        return 'HIGH'
    elif secret_type in medium:
        return 'MEDIUM'
    return 'LOW'

if __name__ == '__main__':
    import sys
    source_dir = sys.argv[1]
    output_file = sys.argv[2]
    
    results = scan_secrets(source_dir)
    with open(output_file, 'w', encoding='utf-8') as f:
        json.dump(results, f, indent=2, ensure_ascii=False)

# Role
You are a security analyst specializing in sensitive information leakage detection.

# Input
- file_inventory.json (file asset manifest)
- raw_secrets.json (script extraction results)

# Task
1. Load raw_secrets.json
2. Filter false positives:
   - Placeholder values (e.g., "YOUR_API_KEY", "example.com")
   - Comments and documentation
   - Test/demo code markers
3. Classify real findings by severity
4. Generate contextual risk assessment

# Output Format
secrets_report.json:
{
  "valid_findings": [
    {
      "type": "api_key",
      "value": "[REDACTED]",
      "file": "pages/user/login.js",
      "line": 42,
      "severity": "CRITICAL",
      "reasoning": "Hardcoded API key in production login flow",
      "recommendation": "Move to secure backend configuration"
    }
  ],
  "false_positives": [...],
  "summary": {
    "total_raw": 156,
    "valid": 23,
    "critical": 3,
    "high": 8,
    "medium": 12
  }
}

# Role
API endpoint extraction and intelligent correlation specialist.

# Input
- file_inventory.json
- raw_endpoints.json (script results)

# Task
1. Group endpoints by BaseURL
2. Reconstruct complete API URLs from fragments
3. Identify request methods from wx.request contexts
4. Map endpoints to source files
5. Flag suspicious patterns (internal IPs, non-HTTPS, hardcoded credentials in URLs)

# Output Format
api_endpoints.json:
{
  "domains": ["https://api.example.com", "https://backend.example.com"],
  "endpoints": [
    {
      "method": "POST",
      "url": "https://api.example.com/api/user/login",
      "base": "https://api.example.com",
      "path": "/api/user/login",
      "source_file": "utils/request.js",
      "line": 15,
      "params": ["username", "password"],
      "security_notes": ["Uses HTTPS", "No credential exposure"]
    }
  ]
}

# Vulnerability Analysis Dimensions

1. **Authentication & Authorization**
   - Token storage in localStorage
   - Session management flaws
   - Missing authentication checks

2. **Data Security**
   - Sensitive data in logs
   - Unencrypted storage
   - PII exposure

3. **Injection Vulnerabilities**
   - SQL injection vectors
   - XSS potential
   - Command injection

4. **Privilege Escalation**
   - Role-based access control bypasses
   - User ID manipulation risks

5. **Payment Security**
   - Amount tampering potential
   - Order verification gaps

6. **Information Leakage**
   - Error messages exposing internals
   - Debug mode in production
   - Version disclosure

7. **Configuration Security**
   - Insecure default settings
   - Missing security headers
   - Weak encryption algorithms

# Output Format
vuln_analysis.json with findings categorized by dimension and severity.

User: Audit this WeChat mini program D:\projects\wxapp
Agent: [Executes full 6-phase pipeline]
Output: wxaudit-output/ with 14 files

User: Analyze D:\wxapp, focus on /api/payment/submit
Agent: [Triggers Phase 2.5 CustomAnalyzer]
Output: Includes custom_analysis.json with deep dive on payment endpoint

User: Audit D:\wxapp, Burp found /api/user/profile returns other users' data when changing uid parameter
Agent: [Correlates with extracted endpoints, flags in vuln_analysis.json under "Privilege Escalation"]

# Verify placement
ls tools/unveilr.exe
# Should show: tools/unveilr.exe

cat wxaudit-output/file_inventory.json | grep ".js"

cat wxaudit-output/secrets_report.json | jq '.summary'

Analyze D:\wxapp, investigate the /api/order/create endpoint and its amount parameter

python tools/scripts/endpoint_extractor.py D:\decompiled_output wxaudit-output/raw_endpoints.json
python tools/scripts/secret_scanner.py D:\decompiled_output wxaudit-output/raw_secrets.json

# Example: Adjust SecretScanner sensitivity
vim agents/agent-02-secret-scanner.md
# Modify the false positive filtering rules section

# Custom Rules (add to agent-05-vuln-analyzer.md)

8. **Business Logic Flaws**
   - Check for discount code stacking vulnerabilities
   - Verify coupon expiration enforcement
   - Validate inventory deduction timing

# Example GitLab CI job
security_audit:
  script:
    - claude-code execute-skill wxmini-security-audit "Audit ./decompiled_app"
    - cat wxaudit-output/findings.json | jq '.summary.critical' | grep -q '^0$' || exit 1

for dir in ./mini-programs/*/; do
  claude-code execute-skill wxmini-security-audit "Audit $dir"
  mv wxaudit-output "results/$(basename $dir)-audit"
done