Burp MCP Vuln Check
langbyyi/CyberStrikeAI-SRC
Automate low-impact web vulnerability verification through Burp MCP.
当目标为微信/支付宝/抖音/百度等小程序（含微信云开发/云函数）、需要小程序包获取与反编译、appid/appsecret/接口提取、微信登录链/支付/越权/WebView/rich-text 渲染/云开发漏洞挖掘时调用。负责小程序全生命周期深度挖掘：包还原 → 代码审计 → 接口与密钥提取 → 登录/支付/越权/渲染/云开发专项 → 验证要点。命中场景：openid 替换越权、code…
Install Miniprogram Security
$ npx skills add zhaji2333/CkSKILLS --skill miniprogram-security -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install zhaji2333/CkSKILLS miniprogram-security --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/miniprogram-security .claude/skills/miniprogram-security && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "miniprogram-security" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/miniprogram-security into .claude/skills/miniprogram-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "miniprogram-security", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/miniprogram-securityType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add zhaji2333/CkSKILLS --skill miniprogram-security -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install zhaji2333/CkSKILLS miniprogram-security --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/miniprogram-security .agents/skills/miniprogram-security && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "miniprogram-security" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/miniprogram-security into .agents/skills/miniprogram-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "miniprogram-security", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add zhaji2333/CkSKILLS --skill miniprogram-security -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install zhaji2333/CkSKILLS miniprogram-security --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/miniprogram-security .cursor/skills/miniprogram-security && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "miniprogram-security" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/miniprogram-security into .cursor/skills/miniprogram-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "miniprogram-security", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/zhaji2333/CkSKILLS.git --path .agents/skills/miniprogram-security--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add zhaji2333/CkSKILLS --skill miniprogram-security -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install zhaji2333/CkSKILLS miniprogram-security --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/miniprogram-security .gemini/skills/miniprogram-security && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "miniprogram-security" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/miniprogram-security into .gemini/skills/miniprogram-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "miniprogram-security", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install zhaji2333/CkSKILLS miniprogram-securityInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add zhaji2333/CkSKILLS --skill miniprogram-security -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/miniprogram-security .github/skills/miniprogram-security && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "miniprogram-security" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/miniprogram-security into .github/skills/miniprogram-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "miniprogram-security", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add zhaji2333/CkSKILLS --skill miniprogram-security -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install zhaji2333/CkSKILLS miniprogram-security --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/miniprogram-security .opencode/skills/miniprogram-security && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "miniprogram-security" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/miniprogram-security into .opencode/skills/miniprogram-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "miniprogram-security", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
miniprogram-security- GitHub stars
- 113
- Token cost
- ~1.5k tokens
- SKILL.md length
- 392 words
- Files
- 1
- Skills in repo
- 15
- Repo updated
- First seen
- Licence
- MIT
At a glance
当目标为微信/支付宝/抖音/百度等小程序（含微信云开发/云函数）、需要小程序包获取与反编译、appid/appsecret/接口提取、微信登录链/支付/越权/WebView/rich-text 渲染/云开发漏洞挖掘时调用。负责小程序全生命周期深度挖掘：包还原 → 代码审计 → 接口与密钥提取 → 登录/支付/越权/渲染/云开发专项 → 验证要点。命中场景：openid 替换越权、code…
- Works in 5 steps: openid 参数可控（最常出洞）：后端把 openid… → code 重放：同一 code 可多次换取 token；code 未绑定会话/设备 → session_key 泄露：后端把 session_key 返回给前端 →… → …
- Tasks that involve Web application vulnerabilities
- SKILL.md covers 何时调用（触发条件）, 快速开始（5 分钟出第一个接口/凭证）, 一、包获取与反编译 and 二、静态审计重点（代码层面）, plus 9 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Miniprogram Security is an agent skill from zhaji2333/CkSKILLS. 当目标为微信/支付宝/抖音/百度等小程序（含微信云开发/云函数）、需要小程序包获取与反编译、appid/appsecret/接口提取、微信登录链/支付/越权/WebView/rich-text 渲染/云开发漏洞挖掘时调用。负责小程序全生命周期深度挖掘：包还原 → 代码审计 → 接口与密钥提取 → 登录/支付/越权/渲染/云开发专项 → 验证要点。命中场景：openid 替换越权、code 登录绕过、支付金额篡改、云函数未授权、web-view/rich-text XSS。
Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Web application vulnerabilities. It works with WeChat. The repository describes itself as: 基于 Claude Code / Codex 的 SRC 漏洞挖掘 Agent 技能体系 —— 将顶尖安全研究员的方法论沉淀为可调度、可复用的 Skill 知识资产。 The licence is MIT.
When your agent uses it
- Tasks that involve Web application vulnerabilities
Example prompts
- “/miniprogram-security”
Workflow steps
5 steps, taken from the first numbered list in SKILL.md.
- openid 参数可控（最常出洞）：后端把 openid 当请求参数接收（{"openid":"xxx"} 直接换 token）→ 填他人 openid = 任意用户登录
- code 重放：同一 code 可多次换取 token；code 未绑定会话/设备
- session_key 泄露：后端把 session_key 返回给前端 → 可解密手机号等敏感数据
- token 可篡改：自定义 token 里含 openid/user_id 明文可改（JWT 弱密钥/无签名，联动 auth-access-control）
- 注册即登录：注册接口直接返回已登录态，可批量注册撞已有 openid
What it can do on your machine
Read from SKILL.md and the folder at commit 482fe78. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Miniprogram Security loads about 1.5k tokens when it runs. Until then it costs about 65 tokens; SKILL.md has 392 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from zhaji2333/CkSKILLS at commit 482fe78, republished under its MIT licence (© zhaji2333). 392 words, ~1,532 tokens.
Download SKILL.mdSave it as
.claude/skills/miniprogram-security/SKILL.md (or your agent's skills folder).- name
- miniprogram-security
- description
- 当目标为微信/支付宝/抖音/百度等小程序（含微信云开发/云函数）、需要小程序包获取与反编译、appid/appsecret/接口提取、微信登录链/支付/越权/WebView/rich-text 渲染/云开发漏洞挖掘时调用。负责小程序全生命周期深度挖掘：包还原 → 代码审计 → 接口与密钥提取 → 登录/支付/越权/渲染/云开发专项 → 验证要点。命中场景：openid 替换越权、code 登录绕过、支付金额篡改、云函数未授权、web-view/rich-text XSS。
miniprogram-security — 小程序专项深度挖掘
与
android-security-audit的分工：本技能专注 小程序（微信/支付宝/抖音/百度）与微信云开发；Android APK 组件安全见android-security-audit。小程序与 APP 后台接口常同源，两技能可联动：先从 APP/小程序提取后端域名，再统一测接口。
何时调用（触发条件）
- 目标是微信/支付宝/抖音/百度/QQ 小程序
- 拿到小程序包（.wxapkg / 分包 / 反编译产物），需要还原源码
- 需要提取接口清单、appid/appsecret、云开发配置、加密/签名逻辑
- 发现微信登录链（wx.login code）、支付、openid/用户 ID 可控、未授权接口
- 发现 web-view / rich-text / JSBridge / 分享跳转 等前端渲染点
- 目标是微信云开发（云函数/云数据库/云存储）
快速开始（5 分钟出第一个接口/凭证）
# Step 1: 定位小程序包（PC 微信缓存目录）
# 微信/WeChat Files/Applet/<appid>/ 下 *.wxapkg（含分包）
# 或开发者工具/手机抓包/第三方平台获取
# Step 2: 反编译
# wxappUnpacker / unveilr / CrackMinApp 解包，得到 app.js、app.json、pages/、utils/、cloudfunctions/
# Step 3: 提取敏感信息与接口（高优先级）
grep -rniE "appid|appsecret|secret|access_key|secret_key|token" <解包目录>/
grep -rEoh "https?://[a-zA-Z0-9._/-]+" <解包目录>/ | sort -u # 后端/业务域名
grep -rn "wx.request|wx.cloud.callFunction|request\(" <解包目录>/ | head -50 # 接口与云函数
# Step 4: 优先验证
# openid 可控 → 替换他人 openid 测越权；登录 code → 重放/替换；支付参数 → 金额篡改一、包获取与反编译
获取途径
- PC 微信：
WeChat Files/Applet/<appid>/下.wxapkg缓存（主包+分包），需先在小程序里打开过 - 微信开发者工具：导入源码调试（拿到项目源码的场景）
- 手机抓包：HTTP(S) 代理 + 小程序包下载接口（配合证书安装）
- 第三方平台：小程序包下载站、GitHub 泄露、历史版本
- 其他平台：支付宝（.axml）、抖音、百度（.swan）结构类似，解包工具对应适配
反编译工具
wxappUnpacker # 经典解包，还原 app.js/pages 结构
unveilr # 较新，支持分包/新版格式
CrackMinApp # 微信小程序一键解包- 解包产物结构：
app.js（全局逻辑）、app.json（页面/权限配置）、pages/*（页面）、utils/*、project.config.json、cloudfunctions/（云函数目录） - 新版分包需先解主包再按
app.json的subpackages配置逐分包解 - 压缩混淆的 JS：先用 js-beautify/反混淆还原，再搜索关键字
还原度确认：解包后核对 app.json 页面数与线上功能是否对应，确认还原完整再开始审计。
二、静态审计重点（代码层面）
app.js / 全局逻辑
- 全局接口封装、请求拦截器（看统一鉴权头怎么带的：token？openid？自定义签名？）
- 登录流程：
wx.login()→ code → 后端换 session/token 的完整链路 - 全局变量：appid、环境 env、后台域名、加密密钥
敏感信息（重点上报项，联动 recon-js-analysis）
appid（正常）、appsecret出现在前端 = 配置错误/泄露（后端才应持有）→ 上报并深挖（可换取 access_token 调接口）- 云开发 env ID、腾讯云 SecretId/SecretKey、OSS/存储桶密钥、内网/后台域名
- 提取的 URL/IP/域名 → 提醒用户关注：可能是 APP/小程序后台接口，进入资产测绘
接口清单提取
wx.request({url: ...})/wx.cloud.callFunction({name: ...})/request(全部列出- 参数结构、鉴权方式（header 里的 token/自定义头）、加密参数
- 隐藏接口：注释掉的、条件分支里的、旧版本接口
渲染与组件
web-view组件的src是否可控rich-text组件的nodes是否渲染用户/AI 输入（XSS）- 自定义 JSBridge /
wx.miniProgram.postMessage、navigateToMiniProgram跳转参数
三、场景表（漏洞全景）
| 场景 | 漏洞类型 | 挖掘要点 |
|---|---|---|
| 微信登录链 | 登录绕过/任意用户登录 | code→session_key→凭证；openid 参数可控、code 重放、session_key 泄露 |
| 支付/订单/退款 | 金额篡改/重复支付/回调绕过 | 下单金额参数可控、回调验签缺失、重复回调、退款金额 |
| 越权/IDOR | openid/用户 ID 替换 | 接口凭证绑定不严、ID 可遍历 |
| 未授权接口 | 敏感数据批量泄露 | 接口无鉴权/鉴权可绕过 |
| web-view | 任意 URL 加载/钓鱼 | src 可控、无域名白名单 |
| rich-text | XSS | nodes 渲染 HTML 无净化（含 AI 输出，联动 xss-frontend-security） |
| JSBridge/postMessage | 敏感能力调用 | 无白名单校验 |
| 云开发 | 云函数未授权/数据越权 | callFunction 任意调用、云数据库权限过大、云存储公开 |
| 本地存储 | 敏感信息泄露 | wx.setStorage 明文 token/密钥/手机号 |
| 分享/跳转 | 开放重定向/钓鱼 | 分享参数可控、navigateToMiniProgram 参数注入 |
| 获取用户信息 | 凭证泄露 | getPhoneNumber/getUserProfile 返回值被滥用/回显 |
| 短信/验证码 | 轰炸/绕过 | 无频率限制、验证码可绕过（与 auth-access-control 联动） |
四、微信登录链专项（最经典，先测）
正常流程：wx.login() 拿 code → 后端调 code2session 换 openid/session_key → 返回自定义 token。
攻击面（按优先级）
- openid 参数可控（最常出洞）：后端把
openid当请求参数接收（{"openid":"xxx"}直接换 token）→ 填他人 openid = 任意用户登录 - code 重放：同一 code 可多次换取 token；code 未绑定会话/设备
- session_key 泄露：后端把 session_key 返回给前端 → 可解密手机号等敏感数据
- token 可篡改：自定义 token 里含 openid/user_id 明文可改（JWT 弱密钥/无签名，联动
auth-access-control） - 注册即登录：注册接口直接返回已登录态，可批量注册撞已有 openid
验证方法
正常：自己的 code 登录 → 拿 token
A/B：把请求里的 openid 换成 B 的 → 若拿到 B 的会话/数据 → 任意用户登录/越权成立
重放：同一个 code 发两次 → 两次都能拿 token → 重放成立五、支付逻辑专项
- 下单金额：
total_fee/amount参数可控、负数、0.01、类型混淆 - 回调验签：支付回调
notify是否验签（MD5/签名比对）；不验签 → 伪造支付成功通知 - 重复回调：同订单重复通知、幂等缺失 → 重复发货/重复入账
- 退款：退款金额/次数可控、退款到他人账户
- 签名机制：参数拼接 + appsecret 签名，参数顺序/编码差异绕过（与
business-logic-race/auth-access-control联动）
Show full SKILL.md (157 more words)Show less
六、云开发/云函数专项
- 云函数未鉴权：
wx.cloud.callFunction({name:"任意函数名"})直接调用，函数内无cloud.getWXContext().OPENID身份校验 → 任意用户调管理员逻辑 - 云数据库权限：默认权限（所有用户可读/可写）、
where条件可控 → 读他人数据、改他人记录 - 云存储：公开读桶、可列举对象
- 环境切换：env ID 可控 → 跨环境访问
- 验证：
wx.cloud.callFunction用他人 openid 上下文调用敏感函数，看是否拒绝
七、前端渲染 XSS 专项（web-view / rich-text）
web-view
src可控 → 加载任意 URL（钓鱼/恶意页面）；src域名白名单可绕过（相似域名、URL 解析差异）- 与 APP 内 WebView 同源风险：加载官方域页面 + JSBridge 注入（联动
xss-frontend-security跳转型 XSS）
rich-text
nodes属性渲染 HTML 无净化 →<img onerror>/<a href="javascript:">在 webview 内执行- AI 输出/聊天记录进 rich-text 渲染 → AI 输出型存储 XSS（联动
xss-frontend-security四 +ai-llm-agent-security3.6）
JSBridge / postMessage
wx.miniProgram.postMessage到 App 端消息处理无白名单navigateToMiniProgram参数注入（跳转任意小程序）
八、分享/跳转专项
- 分享链接/卡片参数可控 → 开放重定向、钓鱼、参数注入
- 页面
onShareAppMessage的 path 参数拼接 → 跳转内部功能（未授权页面） - 扫码进入（scheme 参数）→ 与 Deep Link 类似，参数驱动内部跳转
九、验证要点
- 反编译还原度确认后再审计，防漏接口
- 接口全方法测试（GET/POST/PUT/DELETE）+ 无 token / 伪造 token / 他人 token 对比
- 登录链 A/B 交叉证明：A 凭证访问 B 数据才算越权成立（只读自己数据不报）
- 支付回调重放/验签缺失：真实回调触发一次 → 重放 → 观察状态变化
- 云函数：换 openid 上下文调用敏感函数
- 渲染 XSS：真实触发（web-view 加载恶意 URL / rich-text 弹窗截图）
- 证据链：Burp 请求块 + 截图 + 影响证明；正式报告走
report技能
十、修复建议
- openid/session_key 一律服务端获取，不信任前端传参；接口按服务端解析的身份鉴权
- code 一次性绑定会话、防重放；token 强签名、短时效
- 支付回调强制验签 + 幂等；金额服务端定价，不信任客户端参数
- 云函数入口做
getWXContext().OPENID身份校验；云数据库按最小权限配置 + openid 过滤 - rich-text 渲染白名单净化（DOMPurify 适配小程序）；web-view src 白名单严格校验
- 本地存储不存明文 token/密钥；敏感接口加频率限制
- appsecret/云密钥严禁进前端包，扫描泄露并回收
联动
- 接口/鉴权/越权 →
api-protocol-security/auth-access-control - 支付/竞态 →
business-logic-race - 后端域名/appid/appsecret 提取 →
recon-js-analysis - rich-text/AI 输出渲染 XSS →
xss-frontend-security（四）+ai-llm-agent-security（3.6） - 正式报告 DOCX →
report
© zhaji2333, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in .agents/skills/miniprogram-security of zhaji2333/CkSKILLS.
Open the folder on GitHubat commit 482fe78
Compare with similar skills
Miniprogram Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Miniprogram Security this skillzhaji2333/CkSKILLS | 113 | — | ~1.5k | Automated safety check: Pass | MIT | |
| Burp MCP Vuln Checklangbyyi/CyberStrikeAI-SRC | 134 | — | ~3.1k | Automated safety check: Pass | Apache-2.0 | |
| Security Auditoreigent-ai/eigent | 15k | — | ~1.8k | Automated safety check: Notes | Apache-2.0 | |
| Security Reviewjewbetcha/opentrace | 116 | 18 repos | ~3.1k | Automated safety check: Notes | MIT | |
| Code Audit3stoneBrother/code-audit | 893 | 1 repos | ~2.7k | Automated safety check: Pass | None | |
| Fix Strix Security Findingsusestrix/strix | 67k | — | ~1.5k | Automated safety check: Pass | Apache-2.0 |
Similar skills
Security Auditor
eigent-ai/eigent
Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.
Security Review
jewbetcha/opentrace
A skill your agent uses when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features.
Code Audit
3stoneBrother/code-audit
Professional code security audit skill covering 55+ vulnerability types.
Fix Strix Security Findings
usestrix/strix
Triages findings from a Strix pentest by severity, fixes each root cause with a minimal change, and re-runs Strix to confirm the exploit no longer works.
Security Audit Scanner
ruvnet/ruflo
Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.
More from zhaji2333/CkSKILLS
All 15 skills in this repoApk Reversing
zhaji2333/CkSKILLS
当需要获取目标 APK、识别加固壳类型、脱壳还原 dex、反编译得到 Java/so/H5 全量源码产物，或 android-security-audit 需要可直接开挖的输入时调用。负责 APK → 全量可审计产物（壳识别 → 脱壳 → JADX 反编译 + apktool 资源 + so 提取 + H5/assets 提取）→ 标准目录交付。命中场景：JADX 打开是…
Asc Fast Hunt
zhaji2333/CkSKILLS
当需要在不对 APK 全量反编译的前提下秒级定位硬编码密钥/签名函数/隐藏接口/调试后门，或 APK 过大（100MB）JADX 全量反编译过慢、内存吃紧，或脱壳产物（裸 dex）需要快速检索，或只想先读一下 Manifest 组件面/权限清单时调用。负责基于 Droid ASC 的零预处理快速定位（findrefs 全局交叉引用搜索 + getclass 按需反编译 + Manifest…
Business Logic Race
zhaji2333/CkSKILLS
当目标存在支付/下单/退款/提现/转账/优惠券/积分/红包/会员/订阅/审批/库存/抽奖等业务功能，或发现状态可跳变、金额参数可控、并发可重放时调用。负责业务状态机建模、金额篡改、订单状态跳变、竞态条件与重放攻击深度挖掘。
AI LLM Agent Security
zhaji2333/CkSKILLS
当目标为 LLM 应用/Chatbot/智能客服/AI 助手/Copilot/Agent/RAG 知识库/多模态模型，或发现用户输入进入大模型提示、工具调用、知识库检索、对话记忆、文件解析，或需要测试提示词注入/越狱逃逸/System Prompt 泄露/训练数据与敏感信息泄露/RAG 检索污染/Agent 记忆污染/工具滥用与命令执行/SSRF/沙箱逃逸时调用。负责 OWASP LLM…
Hunt Clueboard
zhaji2333/CkSKILLS
当开始挖新目标、换会话/压缩后续挖、用户说线索板/写板/读板/建板，或信息收集、反编译、JS/接口线索需要跨轮保留时调用。负责为当前系统维护一份 Markdown 线索板（读→挖→写回），不负责拆 webpack、打越权或成稿。模板见同目录 CLUEBOARD.template.md。
Cloud Infra Supply Chain
zhaji2333/CkSKILLS
当目标涉及云资产（对象存储/云元数据/Serverless）、容器/K8s、运维面板（宝塔/Grafana/Zabbix/Jenkins/GitLab/Nacos等）、消息队列/缓存中间件、CI/CD流水线、第三方回调集成、依赖组件CVE、信息泄露配置时调用。负责未授权访问、弱口令、云配置错误、供应链漏洞与敏感信息挖掘。
Related
Works with
Categories
Questions about Miniprogram Security
What does Miniprogram Security do?
当目标为微信/支付宝/抖音/百度等小程序（含微信云开发/云函数）、需要小程序包获取与反编译、appid/appsecret/接口提取、微信登录链/支付/越权/WebView/rich-text 渲染/云开发漏洞挖掘时调用。负责小程序全生命周期深度挖掘：包还原 → 代码审计 → 接口与密钥提取 → 登录/支付/越权/渲染/云开发专项 → 验证要点。命中场景：openid 替换越权、code…. Miniprogram Security is an agent skill from zhaji2333/CkSKILLS.
When should I use Miniprogram Security?
Miniprogram Security fits situations like: tasks that involve Web application vulnerabilities.
How do I install Miniprogram Security in Claude Code?
Run `npx skills add zhaji2333/CkSKILLS --skill miniprogram-security -a claude-code`. Or copy the skill folder (.agents/skills/miniprogram-security in zhaji2333/CkSKILLS) into .claude/skills/miniprogram-security in your project. Claude Code loads it when a task matches its description.
How do I install Miniprogram Security in Codex?
Run `npx skills add zhaji2333/CkSKILLS --skill miniprogram-security -a codex`. Or copy the skill folder (.agents/skills/miniprogram-security in zhaji2333/CkSKILLS) into .agents/skills/miniprogram-security in your project. Codex loads it when a task matches its description.
Can I use Miniprogram Security in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add zhaji2333/CkSKILLS --skill miniprogram-security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/miniprogram-security, .gemini/skills/miniprogram-security, .github/skills/miniprogram-security and .opencode/skills/miniprogram-security in your project.
What does Miniprogram Security need to run?
SKILL.md names no scripts, command-line tools or credentials: Miniprogram Security is instructions for the agent only.
Does Miniprogram Security access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Miniprogram Security safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Miniprogram Security use?
Miniprogram Security is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Miniprogram Security use?
About 1.5k tokens (SKILL.md is roughly 6.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Miniprogram Security?
Skills that share tags, products or a category with Miniprogram Security: Burp MCP Vuln Check (langbyyi/CyberStrikeAI-SRC, 134 stars), Security Auditor (eigent-ai/eigent, 15k stars), Security Review (jewbetcha/opentrace, 116 stars) and Code Audit (3stoneBrother/code-audit, 893 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Miniprogram Security?
zhaji2333 (a GitHub user) maintains it in zhaji2333/CkSKILLS, which has 113 GitHub stars. The repository holds 15 skills in this directory. The repository was last updated on September 15, 2026.
Source: zhaji2333/CkSKILLS on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.