📦
Audit History
auth-wechat-miniprogram - 2 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 2 Latest
Jul 9, 2026, 03:29 PM
Static detections are false positives caused by Markdown inline code, fenced JavaScript examples, reference URLs, and sibling skill paths. The review found two medium-risk content issues: an authorization example that relies on client-supplied owner data and examples that log sensitive identifiers.
1
Files scanned
536
Lines analyzed
5
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Client-Supplied Authorization Boundary
The authorization example compares verified OPENID to event.resourceOwnerId. In a Mini Program cloud function, event data is client-supplied, so this can teach unsafe ownership checks if used alone.
The code example directly uses event.resourceOwnerId as the authorization boundary. Legitimate use is possible, but auth guidance should derive ownership from server-side data.
Medium
Sensitive Identifier Logging in Examples
Several examples log OPENID, UNIONID, or auth result objects. These identifiers are sensitive and should be masked or limited to local debugging guidance.
The examples explicitly log user identifiers and auth user objects. The intent appears instructional, but the pattern can expose private identifiers in production logs.
Risk Factors
⚙️ External commands (50)
SKILL.md:3 SKILL.md:10 SKILL.md:12 SKILL.md:13 SKILL.md:15 SKILL.md:21 SKILL.md:26 SKILL.md:31 SKILL.md:32 SKILL.md:42 SKILL.md:57 SKILL.md:71 SKILL.md:87 SKILL.md:88 SKILL.md:107 SKILL.md:108 SKILL.md:109 SKILL.md:114 SKILL.md:129 SKILL.md:131-142 SKILL.md:142-146 SKILL.md:146-147 SKILL.md:147-148 SKILL.md:148-156 SKILL.md:156-180 SKILL.md:180-184 SKILL.md:184-185 SKILL.md:185-186 SKILL.md:186-187 SKILL.md:187-191 SKILL.md:191-195 SKILL.md:195-196 SKILL.md:196-197 SKILL.md:197-198 SKILL.md:198-206 SKILL.md:206-232 SKILL.md:232-236 SKILL.md:236-247 SKILL.md:247-271 SKILL.md:271-275 SKILL.md:275-313 SKILL.md:313-319 SKILL.md:319-320 SKILL.md:320-329 SKILL.md:329-333 SKILL.md:333-339 SKILL.md:339-341 SKILL.md:341-345 SKILL.md:345-355 SKILL.md:355-359
🌐 Network access (4)
📁 Filesystem access (2)
Audited by: codex
Jul 9, 2026, 03:29 PM
Static detections are false positives caused by Markdown inline code, fenced JavaScript examples, reference URLs, and sibling skill paths. The review found two medium-risk content issues: an authorization example that relies on client-supplied owner data and examples that log sensitive identifiers.
1
Files scanned
536
Lines analyzed
5
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Client-Supplied Authorization Boundary
The authorization example compares verified OPENID to event.resourceOwnerId. In a Mini Program cloud function, event data is client-supplied, so this can teach unsafe ownership checks if used alone.
The code example directly uses event.resourceOwnerId as the authorization boundary. Legitimate use is possible, but auth guidance should derive ownership from server-side data.
Medium
Sensitive Identifier Logging in Examples
Several examples log OPENID, UNIONID, or auth result objects. These identifiers are sensitive and should be masked or limited to local debugging guidance.
The examples explicitly log user identifiers and auth user objects. The intent appears instructional, but the pattern can expose private identifiers in production logs.
Risk Factors
⚙️ External commands (50)
SKILL.md:3 SKILL.md:10 SKILL.md:12 SKILL.md:13 SKILL.md:15 SKILL.md:21 SKILL.md:26 SKILL.md:31 SKILL.md:32 SKILL.md:42 SKILL.md:57 SKILL.md:71 SKILL.md:87 SKILL.md:88 SKILL.md:107 SKILL.md:108 SKILL.md:109 SKILL.md:114 SKILL.md:129 SKILL.md:131-142 SKILL.md:142-146 SKILL.md:146-147 SKILL.md:147-148 SKILL.md:148-156 SKILL.md:156-180 SKILL.md:180-184 SKILL.md:184-185 SKILL.md:185-186 SKILL.md:186-187 SKILL.md:187-191 SKILL.md:191-195 SKILL.md:195-196 SKILL.md:196-197 SKILL.md:197-198 SKILL.md:198-206 SKILL.md:206-232 SKILL.md:232-236 SKILL.md:236-247 SKILL.md:247-271 SKILL.md:271-275 SKILL.md:275-313 SKILL.md:313-319 SKILL.md:319-320 SKILL.md:320-329 SKILL.md:329-333 SKILL.md:333-339 SKILL.md:339-341 SKILL.md:341-345 SKILL.md:345-355 SKILL.md:355-359
🌐 Network access (4)
📁 Filesystem access (2)
Audited by: codex