wxmini-security-audit

A static security audit on WeChat mini-programs decompiles wxapkg content and analyzes it for exposed secrets, API endpoints, and crypto weaknesses. This Skill automates that pipeline locally, using deterministic Python scripts and LLM agents to produce structured findings without network activity.

Yes, scanning for leaked secrets and API endpoints can run entirely offline. The process executes pure static analysis using a decompiler binary and deterministic Python extraction scripts, ensuring no network requests or attack-code generation occurs during the local audit.

Static analysis for WeChat mini-program vulnerability detection is the process of reviewing decompiled source code to identify security risks without executing the application. It uses dual-layer detection, combining deterministic regex pre-scanning with LLM-based agents for contextual triage.

To extract API endpoints from a wxapkg file for security review, you decompile the package and run automated endpoint mining scripts. These scripts correlate extracted request contexts with specific parameters to produce structured JSON inventories for downstream analysis.

No, WeChat mini-program static analysis does not require a network connection or active testing. The auditing process is fully local, relying on a decompiler binary and Python scripts to analyze vulnerability signals without generating attack code or sending network requests.

A WeChat mini-program security audit generates a summary report alongside structured JSON inventories. These output artifacts include detailed file inventories, extracted endpoints, discovered secrets, crypto analysis results, and identified vulnerabilities for downstream review.