技能 miniprogram-development
📦
miniprogram-development
v2.23.8 内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问
使用 CloudBase 构建微信小程序
微信小程序开发需要平台特定的结构、预览和 CloudBase 决策。此技能可指导设置、调试、发布检查和 CloudBase 集成。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "miniprogram-development" from https://skillstore.io/skills/tencentcloudbase-miniprogram-development.md and its manifest at https://skillstore.io/api/skills/tencentcloudbase-miniprogram-development/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“miniprogram-development”。 审查一个存在不必要图标间距的小程序标签栏。
预期结果:
- 在不需要图标时，推荐使用纯文本 custom tabBar。
- 解释哪些布局属性可以移除空白图标空间。
- 列出需要协同变更的文件。
正在使用“miniprogram-development”。 为用户生成图片上传规划 CloudBase 支持。
预期结果:
- 将客户端上传步骤与权限敏感的服务端逻辑分离。
- 指出环境选择和存储权限检查。
- 警告不要硬编码环境猜测。
正在使用“miniprogram-development”。 为真机预览准备项目。
预期结果:
- 检查 appid、miniprogramRoot、页面注册和本地资源。
- 优先使用 WeChat Developer Tools 进行模拟器和设备测试。
- 仅在 DevTools 不可用时使用 miniprogram-ci。
安全审计
高风险v2 • 2026/7/9 打开版本化报告
Most static command findings are false positives caused by Markdown code spans and fenced examples. Confirmed issues are the mutable external instruction URLs and parent-directory references to sibling skills outside the package. No prompt injection language was found in the reviewed files.
3
已扫描文件
423
分析行数
12
复核项
0
已忽略误报
已确认安全问题 (1)
高
Unpinned External Instruction References
The skill tells agents to use raw external skill and protocol URLs from a main branch. Future remote changes could alter agent instructions after this package is reviewed.
The referenced URLs point to raw external instruction files on a mutable branch. The skill explicitly presents them as entries or fallbacks for agent use.
能力复核项 (12)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Path traversal sequence
- CloudBase auth -> `../auth-wechat/SKILL.md` (standalone fallback: `https://cnb.cool/tencent/cloud/
The skill directs agents to read sibling paths using ../ outside the packaged skill directory. The targets are fixed, but they cross the audited package boundary.
高
Path traversal sequence
- CloudBase document DB -> `../no-sql-wx-mp-sdk/SKILL.md` (standalone fallback: `https://cnb.cool/te
The skill directs agents to read sibling paths using ../ outside the packaged skill directory. The targets are fixed, but they cross the audited package boundary.
高
Path traversal sequence
- Mini Program WeChat Pay or Integration Center generated payment functions -> `../cloudbase-wechat-
The skill directs agents to read sibling paths using ../ outside the packaged skill directory. The targets are fixed, but they cross the audited package boundary.
高
Path traversal sequence
- UI generation -> `../ui-design/SKILL.md` (standalone fallback: `https://cnb.cool/tencent/cloud/clo
The skill directs agents to read sibling paths using ../ outside the packaged skill directory. The targets are fixed, but they cross the audited package boundary.
低
Hardcoded URL
- CloudBase main entry: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/sk
The URL is documentation-like, but it points to mutable external skill or protocol content. Agents may import unreviewed instructions from that remote source.
低
Hardcoded URL
- Current skill raw source: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/mai
The URL is documentation-like, but it points to mutable external skill or protocol content. Agents may import unreviewed instructions from that remote source.
低
Hardcoded URL
- Change Safety Protocol: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/
The URL is documentation-like, but it points to mutable external skill or protocol content. Agents may import unreviewed instructions from that remote source.
低
Hardcoded URL
- Deployment Gate: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/skills/
The URL is documentation-like, but it points to mutable external skill or protocol content. Agents may import unreviewed instructions from that remote source.
低
Hardcoded URL
- CloudBase auth -> `../auth-wechat/SKILL.md` (standalone fallback: `https://cnb.cool/tencent/cloud/
The URL is documentation-like, but it points to mutable external skill or protocol content. Agents may import unreviewed instructions from that remote source.
低
Hardcoded URL
- CloudBase document DB -> `../no-sql-wx-mp-sdk/SKILL.md` (standalone fallback: `https://cnb.cool/te
The URL is documentation-like, but it points to mutable external skill or protocol content. Agents may import unreviewed instructions from that remote source.
低
Hardcoded URL
- Mini Program WeChat Pay or Integration Center generated payment functions -> `../cloudbase-wechat-
The URL is documentation-like, but it points to mutable external skill or protocol content. Agents may import unreviewed instructions from that remote source.
低
Hardcoded URL
- UI generation -> `../ui-design/SKILL.md` (standalone fallback: `https://cnb.cool/tencent/cloud/clo
The URL is documentation-like, but it points to mutable external skill or protocol content. Agents may import unreviewed instructions from that remote source.
风险因素
⚙️ 外部命令 (50)
SKILL.md:3 SKILL.md:10 SKILL.md:12 SKILL.md:13 SKILL.md:15 SKILL.md:18 SKILL.md:19 SKILL.md:29 SKILL.md:33 SKILL.md:34 SKILL.md:35 SKILL.md:36 SKILL.md:41 SKILL.md:46 SKILL.md:48 SKILL.md:49 SKILL.md:63 SKILL.md:64 SKILL.md:65 SKILL.md:77 SKILL.md:78 SKILL.md:81 SKILL.md:83 SKILL.md:91 SKILL.md:100 SKILL.md:101 SKILL.md:105 SKILL.md:106 SKILL.md:107 SKILL.md:110 SKILL.md:111 SKILL.md:115 SKILL.md:117 SKILL.md:119 SKILL.md:121-132 SKILL.md:132-134 SKILL.md:134 SKILL.md:138-139 SKILL.md:139-145 SKILL.md:145-150 SKILL.md:150-152 SKILL.md:152-158 SKILL.md:158-160 SKILL.md:160-162 SKILL.md:162-168 SKILL.md:168-170 SKILL.md:170-172 SKILL.md:172-176 SKILL.md:176-178 SKILL.md:178-180
🌐 网络访问 (8)
📁 文件系统访问 (4)
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/tencentcloudbase-miniprogram-development/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/tencentcloudbase-miniprogram-development?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/tencentcloudbase-miniprogram-development?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/tencentcloudbase-miniprogram-development/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/tencentcloudbase-miniprogram-development.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
tencentcloudbase. (2026). miniprogram-development security audit report (audit version 2) [Author version 2.23.8]. Skillstore. https://skillstore.io/skills/tencentcloudbase-miniprogram-development/audits/2BibTeX 引用
@techreport{tencentcloudbase-tencentcloudbase-miniprogram-development-2026,
author = {tencentcloudbase},
title = {miniprogram-development security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/tencentcloudbase-miniprogram-development/audits/2},
note = {Author version 2.23.8}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "miniprogram-development security audit report (audit version 2)"
version: "2.23.8"
type: report
authors:
- name: "tencentcloudbase"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/tencentcloudbase-miniprogram-development/audits/2"
identifiers:
- type: other
value: "skillstore:tencentcloudbase-miniprogram-development:audit:2"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 41
架构
100
可维护性
87
内容
65
社区
91
规范符合性
你能构建什么
创建小程序页面
为新功能规划页面文件、组件结构、路由和必需配置。
审查预览就绪状态
在真机测试前检查项目配置、appid、miniprogramRoot、资源和预览工作流。
添加 CloudBase 集成
为环境设置、身份、数据库访问、存储和云函数应用 wx.cloud 模式。
试试这些提示
创建基础页面
为 [feature] 创建一个微信小程序页面。包含必需的页面文件，并说明每个文件应放在哪里。
审查项目配置
审查此小程序项目配置的预览就绪状态。检查 appid、miniprogramRoot、页面注册和资源路径。
添加 CloudBase 数据流
为 [feature] 设计一个 CloudBase 数据流。正确使用 wx.cloud，并将客户端安全写入与需要特权的云函数工作分离。
准备发布工作流
准备此小程序用于预览或上传。识别 DevTools、真机测试、miniprogram-ci 和发布门禁所需的检查项。
最佳实践
- 编辑页面文件前，确认已配置的小程序根目录。
- 仅在项目明确使用 CloudBase 时使用 CloudBase 规则。
- 在上传或发布前完成预览和发布检查。
避免
- 不要将 Web 身份验证模式照搬到小程序中。
- 当纯文本标签满足需求时，不要创建基于图标的标签栏。
- 不要在未检查 appid、资源和项目配置的情况下发布。
常见问题
此技能支持哪些项目？
它支持微信小程序项目，尤其是需要结构、预览、发布或 CloudBase 指导的项目。
它要求使用 CloudBase 吗？
不需要。它仅在用户或代码库显示使用 CloudBase 时才应用 CloudBase 规则。
它能帮助使用 WeChat Developer Tools 吗？
可以。它会指导模拟器、面板调试、预览和真机验证工作流。
它能使用 miniprogram-ci 吗？
可以。它将 miniprogram-ci 作为预览、上传和构建工作流的备用方案。
它覆盖 WeChat Pay 吗？
仅在路由层面覆盖。支付回调、退款和 OAuth 细节会委托给另一个技能。
哪些 AI 工具可以使用它？
报告列出了对 Claude、Codex 和 Claude Code 的支持。
开发者详情
许可证
MIT
作者版本
v2.23.8
Skillstore 修订
r1
引用
24b2fe42a456262f3fd0fb3df72e12d9ed2c32ec
维护新鲜度
2026/7/18
使用量
1 次下载 · 0 次浏览
文件结构