技能 miniprogram-development
📦
miniprogram-development
v2.23.8 內容修訂 r1 高風險 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取
使用 CloudBase 建構微信小程式
微信小程式開發需要平台特定的結構、預覽與 CloudBase 決策。此技能會引導設定、偵錯、發布檢查與 CloudBase 整合。
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "miniprogram-development" from https://skillstore.io/skills/tencentcloudbase-miniprogram-development.md and its manifest at https://skillstore.io/api/skills/tencentcloudbase-miniprogram-development/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「miniprogram-development」。 審查一個有不必要圖示間距的小程式 tab bar。
預期結果:
- 在不需要圖示時建議使用純文字自訂 tabBar。
- 說明哪些版面配置屬性可移除空白圖示空間。
- 列出需要協調變更的檔案。
正在使用「miniprogram-development」。 規劃使用者產生圖片上傳的 CloudBase 支援。
預期結果:
- 將客戶端上傳步驟與權限敏感的伺服器邏輯分開。
- 指出環境選擇與儲存權限檢查。
- 警告不要硬編碼猜測環境。
正在使用「miniprogram-development」。 準備專案以進行真機預覽。
預期結果:
- 檢查 appid、miniprogramRoot、頁面註冊與本機資源。
- 優先使用 WeChat Developer Tools 進行模擬器與裝置測試。
- 僅在 DevTools 無法使用時才使用 miniprogram-ci。
安全審計
高風險v2 • 2026/7/9 開啟版本化報告
Most static command findings are false positives caused by Markdown code spans and fenced examples. Confirmed issues are the mutable external instruction URLs and parent-directory references to sibling skills outside the package. No prompt injection language was found in the reviewed files.
3
已掃描檔案
423
分析行數
12
複核項目
0
已忽略的誤報
已確認的安全問題 (1)
高
Unpinned External Instruction References
The skill tells agents to use raw external skill and protocol URLs from a main branch. Future remote changes could alter agent instructions after this package is reviewed.
The referenced URLs point to raw external instruction files on a mutable branch. The skill explicitly presents them as entries or fallbacks for agent use.
能力複核項目 (12)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
高
Path traversal sequence
- CloudBase auth -> `../auth-wechat/SKILL.md` (standalone fallback: `https://cnb.cool/tencent/cloud/
The skill directs agents to read sibling paths using ../ outside the packaged skill directory. The targets are fixed, but they cross the audited package boundary.
高
Path traversal sequence
- CloudBase document DB -> `../no-sql-wx-mp-sdk/SKILL.md` (standalone fallback: `https://cnb.cool/te
The skill directs agents to read sibling paths using ../ outside the packaged skill directory. The targets are fixed, but they cross the audited package boundary.
高
Path traversal sequence
- Mini Program WeChat Pay or Integration Center generated payment functions -> `../cloudbase-wechat-
The skill directs agents to read sibling paths using ../ outside the packaged skill directory. The targets are fixed, but they cross the audited package boundary.
高
Path traversal sequence
- UI generation -> `../ui-design/SKILL.md` (standalone fallback: `https://cnb.cool/tencent/cloud/clo
The skill directs agents to read sibling paths using ../ outside the packaged skill directory. The targets are fixed, but they cross the audited package boundary.
低
Hardcoded URL
- CloudBase main entry: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/sk
The URL is documentation-like, but it points to mutable external skill or protocol content. Agents may import unreviewed instructions from that remote source.
低
Hardcoded URL
- Current skill raw source: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/mai
The URL is documentation-like, but it points to mutable external skill or protocol content. Agents may import unreviewed instructions from that remote source.
低
Hardcoded URL
- Change Safety Protocol: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/
The URL is documentation-like, but it points to mutable external skill or protocol content. Agents may import unreviewed instructions from that remote source.
低
Hardcoded URL
- Deployment Gate: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/skills/
The URL is documentation-like, but it points to mutable external skill or protocol content. Agents may import unreviewed instructions from that remote source.
低
Hardcoded URL
- CloudBase auth -> `../auth-wechat/SKILL.md` (standalone fallback: `https://cnb.cool/tencent/cloud/
The URL is documentation-like, but it points to mutable external skill or protocol content. Agents may import unreviewed instructions from that remote source.
低
Hardcoded URL
- CloudBase document DB -> `../no-sql-wx-mp-sdk/SKILL.md` (standalone fallback: `https://cnb.cool/te
The URL is documentation-like, but it points to mutable external skill or protocol content. Agents may import unreviewed instructions from that remote source.
低
Hardcoded URL
- Mini Program WeChat Pay or Integration Center generated payment functions -> `../cloudbase-wechat-
The URL is documentation-like, but it points to mutable external skill or protocol content. Agents may import unreviewed instructions from that remote source.
低
Hardcoded URL
- UI generation -> `../ui-design/SKILL.md` (standalone fallback: `https://cnb.cool/tencent/cloud/clo
The URL is documentation-like, but it points to mutable external skill or protocol content. Agents may import unreviewed instructions from that remote source.
風險因素
⚙️ 外部命令 (50)
SKILL.md:3 SKILL.md:10 SKILL.md:12 SKILL.md:13 SKILL.md:15 SKILL.md:18 SKILL.md:19 SKILL.md:29 SKILL.md:33 SKILL.md:34 SKILL.md:35 SKILL.md:36 SKILL.md:41 SKILL.md:46 SKILL.md:48 SKILL.md:49 SKILL.md:63 SKILL.md:64 SKILL.md:65 SKILL.md:77 SKILL.md:78 SKILL.md:81 SKILL.md:83 SKILL.md:91 SKILL.md:100 SKILL.md:101 SKILL.md:105 SKILL.md:106 SKILL.md:107 SKILL.md:110 SKILL.md:111 SKILL.md:115 SKILL.md:117 SKILL.md:119 SKILL.md:121-132 SKILL.md:132-134 SKILL.md:134 SKILL.md:138-139 SKILL.md:139-145 SKILL.md:145-150 SKILL.md:150-152 SKILL.md:152-158 SKILL.md:158-160 SKILL.md:160-162 SKILL.md:162-168 SKILL.md:168-170 SKILL.md:170-172 SKILL.md:172-176 SKILL.md:176-178 SKILL.md:178-180
🌐 網路存取 (8)
📁 檔案系統存取 (4)
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/tencentcloudbase-miniprogram-development/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/tencentcloudbase-miniprogram-development?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/tencentcloudbase-miniprogram-development?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/tencentcloudbase-miniprogram-development/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/tencentcloudbase-miniprogram-development.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
tencentcloudbase. (2026). miniprogram-development security audit report (audit version 2) [Author version 2.23.8]. Skillstore. https://skillstore.io/skills/tencentcloudbase-miniprogram-development/audits/2BibTeX 引用
@techreport{tencentcloudbase-tencentcloudbase-miniprogram-development-2026,
author = {tencentcloudbase},
title = {miniprogram-development security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/tencentcloudbase-miniprogram-development/audits/2},
note = {Author version 2.23.8}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "miniprogram-development security audit report (audit version 2)"
version: "2.23.8"
type: report
authors:
- name: "tencentcloudbase"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/tencentcloudbase-miniprogram-development/audits/2"
identifiers:
- type: other
value: "skillstore:tencentcloudbase-miniprogram-development:audit:2"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 41
架構
100
可維護性
87
內容
65
社群
91
規範符合度
你可以打造什麼
建立小程式頁面
為新功能規劃頁面檔案、元件結構、路由與必要設定。
審查預覽準備狀態
在裝置測試前檢查專案設定、appid、miniprogramRoot、資源與預覽工作流程。
新增 CloudBase 整合
套用 wx.cloud 模式來處理環境設定、身分、資料庫存取、儲存與雲函式。
試試這些提示
建立基本頁面
為 [feature] 建立一個微信小程式頁面。包含必要的頁面檔案，並說明每個檔案應放置的位置。
審查專案設定
審查此小程式專案設定是否已準備好預覽。檢查 appid、miniprogramRoot、頁面註冊與資源路徑。
新增 CloudBase 資料流程
為 [feature] 設計 CloudBase 資料流程。正確使用 wx.cloud，並區分客戶端安全寫入與具權限的雲函式工作。
準備發布工作流程
準備此小程式以進行預覽或上傳。識別 DevTools、真機測試、miniprogram-ci 與發布閘門所需的檢查。
最佳實務
- 編輯頁面檔案前，確認已設定的小程式根目錄。
- 僅在專案明確使用 CloudBase 時套用 CloudBase 規則。
- 在上傳或發布前完成預覽與發布檢查。
避免
- 不要將 Web 驗證模式直接套用到小程式。
- 當純文字分頁符合需求時，不要建立以圖示為主的 tab bar。
- 未檢查 appid、資源與專案設定前不要發布。
常見問題
此技能支援哪些專案？
它支援微信小程式專案，特別是需要結構、預覽、發布或 CloudBase 指引的專案。
它需要 CloudBase 嗎？
不需要。它只會在使用者或程式碼庫顯示使用 CloudBase 時套用 CloudBase 規則。
它能協助使用 WeChat Developer Tools 嗎？
可以。它會引導模擬器、面板偵錯、預覽與真機驗證工作流程。
它可以使用 miniprogram-ci 嗎？
可以。它將 miniprogram-ci 視為預覽、上傳與建置工作流程的備用方案。
它涵蓋 WeChat Pay 嗎？
僅限於路由層級。支付回呼、退款與 OAuth 細節會委派給另一個技能。
哪些 AI 工具可以使用它？
報告列出對 Claude、Codex 與 Claude Code 的支援。
開發者詳細資訊
授權
MIT
作者版本
v2.23.8
Skillstore 修訂
r1
引用
24b2fe42a456262f3fd0fb3df72e12d9ed2c32ec
維護新鮮度
2026/7/18
使用量
1 次下載 · 0 次瀏覽
檔案結構