Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cyj4578/chen-skillshub --skill mini-program-sastgit clone --depth 1 https://github.com/cyj4578/chen-skillshubWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cyj4578/chen-skillshub/mini-program-sast)<a href="https://agentmods.dev/skills/cyj4578/chen-skillshub/mini-program-sast"><img src="https://agentmods.dev/badge/skills/cyj4578/chen-skillshub/mini-program-sast.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.04901 |
| Opus 5 | $0.00039 | $0.02450 |
| Sonnet 5 | $0.00015 | $0.00980 |
| Haiku 4.5 | $0.00008 | $0.00490 |
Grade A, and why
mini-program-sast scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 257 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mini Program SAST
微信小程序前端静态安全扫描。用户提供 AppID → 自动定位本地缓存中的 .wxapkg 包 → 提取可读代码 → 模式匹配漏洞扫描 → 输出分级安全审计报告（HTML 格式，浏览器打印即可导出 PDF）。
核心能力
用户给 AppID → 我找缓存包 → 提取代码 → 出报告（Critical / High / Medium / Low）
能做什么：
- 扫描本地微信缓存中的小程序
.wxapkg包 - 从二进制包中提取可读字符串进行模式匹配
- 检测小程序特有漏洞：
wx.setStorageSync明文存储、wx.logincode 泄露、openId URL参数传递、硬编码凭证、Mock模式残留等 - 分析 API 端点、第三方SDK、支付安全配置
- 输出分级报告 + 每个漏洞的修复代码示例
不能做什么：
- ❌ 不扫描未在本地打开过的小程序（缓存中无
.wxapkg文件） - ❌ 不穿透小程序后端服务做渗透测试
- ❌ 不绕过微信加密传输层抓包
- ❌ 不解密经过自定义加密的
.wxapkg包（部分分包使用了非标准加密） - ❌ 不替代微信官方「小程序安全扫描」服务（
miniprogram-ci的analyse命令）
前置条件（⚠️ 用户必须满足）
在使用本 Skill 之前，用户必须确保以下条件全部满足：
| 条件 | 说明 | 如何验证 |
|---|---|---|
| ① 小程序已在本地打开过 | 在 Mac/Windows 微信客户端中至少打开过一次该小程序 | 打开微信 → 搜索小程序 → 进入任意页面即可 |
| ② 本地缓存未被清理 | 微信缓存目录中存在该小程序的 .wxapkg 文件 |
Skill 会自动检测路径是否存在 |
| ③ 提供正确的 AppID | 小程序的唯一标识，通常为 wx 开头的 16 位字符串 |
两种获取方式见下方 |
| ④ Mac / Windows 电脑 | 需要访问本地文件系统，手机端无法使用本 Skill | — |
AppID 获取方式
方式一（后台查看）： 登录微信公众平台 → 开发管理 → 开发设置 → AppID（需为小程序管理员或开发者）
方式二（微信内查看）： 点击小程序 → 点击右上角 ··· → 点击「小程序主页」/「简介」→ 在简介页面可看到 AppID（适用于任意小程序，无需管理员权限）
缓存文件位置：
| 操作系统 | 缓存路径 |
|---|---|
| macOS（官网版微信） | ~/Library/Containers/com.tencent.xinWeChat/Data/.wxapplet/packages/{AppID}/ |
| macOS（AppStore 版微信） | ~/Library/Containers/com.tencent.xinWeChat/Data/Documents/app_data/radium/users/*/applet/packages/{AppID}/ |
| Windows | %USERPROFILE%\Documents\WeChat Files\Applet\{AppID}\ |
⚠️ AppStore 版微信路径差异：AppStore 沙盒版微信的缓存位于
Data/Documents/app_data/radium/子路径下，且包含随机用户 ID 目录，需要用find命令广播搜索。Skill 会自动按顺序尝试：官网版路径 → AppStore 路径 → 全盘广播搜索。
每个 AppID 目录下有多个版本子目录（如 /0/、/31/、/40/、/1835/），每个子目录中包含 __APP__.wxapkg（主包）和可能存在的 _pagesA_.wxapkg、_package_c_.wxapkg 等分包。
触发条件
以下任一场景触发本 Skill：
| 用户说的话 | 触发 |
|---|---|
| "帮我扫描/审计一下这个小程序" | ✅ |
"这个 AppID wx... 有没有安全漏洞" |
✅ |
| "检测小程序有没有密钥泄露" | ✅ |
| "小程序源码安全审计" | ✅ |
| "小程序等保 / 安全合规检查" | ✅ |
| "帮我看看这个小程序的代码" | ✅ |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 257 lines · 77 tokens per session scan A 21f8b1d4bac9
mini-program-sast is a skill published in the GitHub repository cyj4578/chen-skillshub (11 stars, last pushed 1mo ago), licensed MIT. It adds 77 tokens to every session and 4,901 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
next-partial-prefetching-adoption
Turn on Partial Prefetching in a Next.js app and work through the insights it surfaces. Use when the user wants to enable or adopt Partial Prefetching, flip the partialPrefetching flag, opt routes in with export const prefetch = 'partial', audit Link prefetch={true} behavior, preserve existing prefetched UI with…
chronicle
Analyze Copilot session history for standup reports, usage tips, session search, and session reindexing. Use when the user asks for a standup, daily summary, usage tips, workflow recommendations, wants to search or find past sessions by keyword/file/PR, wants to reindex their session store, or asks about deleting…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…