wxmini-security-audit

Run `npx skills add sssmmmwww/wxmini-security-audit --all -g -y` in your terminal to install the skill globally. You also need to place the open-source unveilr.exe decompiler into the tools folder.

Just give the skill your mini-program directory path, for example: audit this mini-program D:\wechat\target. It automatically decompiles the package, scans for secrets and endpoints, analyzes encryption and vulnerabilities, then outputs a full security report.

It finds hardcoded keys and tokens, internal IPs, personal data, API endpoints, weak encryption setups, and vulnerabilities across authentication, injection, payment, and access control. All findings include risk ratings and fix suggestions.

Yes. Mention a specific endpoint, parameter, or concern in your request, such as a tamperable amount parameter found in Burp, and the skill runs a deep targeted analysis phase on it.

No. The current version only supports Windows because the bundled unveilr.exe decompiler is a Windows executable. Python 3 is also required but needs no extra packages.