wxmini-security-audit

# wxmini-security-audit > Skill by [ara.so](https://ara.so) — Security Skills collection. Automated security auditing framework for WeChat mini-programs using Claude Code Agent Teams. Orchestrates 7 specialized agents to perform comprehensive static analysis covering sensitive information leakage, API endpoint extraction, cryptographic analysis, and vulnerability detection across seven security dimensions. ## What It Does - **Multi-Agent Orchestration**: Coordinates 7 specialized agents (decompiler, secret scanner, endpoint miner, crypto analyzer, vulnerability analyzer, custom analyzer, reporter) - **Dual-Layer Architecture**: Python regex scripts ensure 100% rule coverage, LLM agents provide intelligent analysis with context awareness - **Parallel Phase 2 Execution**: Runs 4 analysis agents simultaneously to minimize audit time - **User Intent Parsing**: Automatically triggers deep custom analysis when specific endpoints/parameters are mentioned - **Pure Static Analysis**: Zero network requests, no attack code generation, fully local processing - **Comprehensive Reporting**: Generates both summary reports and detailed documentation with structured data exports ## Architecture The framework operates in sequential phases: 1. **Phase 0**: User intent parsing (extracts target path, creates output directory, parses requirements) 2. **Phase 1**: Decompilation (unveilr.exe processes wxapkg files, generates file inventory) 3. **Phase 1.5**: Script pre-scanning (Python regex extracts raw endpoints and secrets) 4. **Phase 2**: Parallel analysis (4 agents run simultaneously: SecretScanner, EndpointMiner, CryptoAnalyzer, VulnAnalyzer) 5. **Phase 2.5**: Custom analysis (triggered only when user specifies particular endpoints/parameters) 6. **Phase 3**: Report generation (aggregates findings into structured reports) ## Installation ### Prerequisites - Claude Code CLI environment with Agent Teams/Skill support - Python 3.x (standard library only, no external dependencies) - Windows platform (current version requires unveilr.exe) - unveilr.exe binary (WeChat mini-program decompiler) ### Setup Clone the repository into your Claude Code Skills directory: ```bash git clone https://github.com/sssmmmwww/wxmini-security-audit.git cd wxmini-security-audit ``` Obtain `unveilr.exe` from the [unveilr project](https://github.com/nicholaschan23/unveilr) and place it in the `tools/` directory: ``` wxmini-security-audit/ ├── SKILL.md ├── agents/ │ ├── agent-01-decompiler.md │ ├── agent-02-secret-scanner.md │ ├── agent-03-endpoint-miner.md │ ├── agent-04-crypto-analyzer.md │ ├── agent-05-vuln-analyzer.md │ ├── agent-06-reporter.md │ └── agent-07-custom-analyzer.md └── tools/ ├── unveilr.exe # Place here └── scripts/ ├── endpoint_extractor.py └── secret_scanner.py ``` ## Usage ### Basic Audit Trigger the audit by providing a mini-program directory path: ``` Audit this WeChat mini program D:\wechat\miniapp\wxapkg_files ``` ``` Analyze this mini program for security issues C:\miniprogram\target ``` ### Focused Analysis Specify particular concerns to trigger Phase 2.5 custom analysis: ``` Audit this mini program D:\wxapp, focus on the /api/user/login endpoint ``` ``` Scan D:\wxapp for vulnerabilities, particularly payment security and privilege escalation ``` ### With External Tool Integration Provide context from intercepting proxies: ``` Analyze this mini program D:\wxapp, Burp Suite captured the /api/pay endpoint with a tamperable amount parameter ``` ### Output Structure After completion, find results in `wxaudit-output/`: ``` wxaudit-output/ ├── security_report.md # Primary findings, risk assessment, remediation ├── api_endpoints_full.md # Complete endpoint inventory ├── secrets_full.md # All sensitive findings including false positives ├── findings.json # Structured summary data ├── domains.txt # Extracted domain list ├── endpoints_fuzz.txt # Fuzzing-ready endpoint list ├── file_inventory.json # Decompiled file asset manifest ├── raw_endpoints.json # Regex extraction raw results ├── raw_secrets.json # Secret scanner raw results ├── secrets_report.json # Intelligent secret analysis ├── api_endpoints.json # Intelligent API analysis ├── crypto_analysis.json # Cryptographic assessment ├── vuln_analysis.json # Vulnerability findings └── custom_analysis.json # Custom requirement analysis (conditional) ``` ## Python Script Layer ### Endpoint Extraction Script Located at `tools/scripts/endpoint_extractor.py`, this script provides 100% rule coverage for API endpoint detection: ```python import re import json import os def extract_endpoints(source_dir): """ Extract API endpoints from decompiled mini-program files. Returns: List of dicts with {pattern, file, line, context} """ endpoints = [] patterns = [ r'https?://[^\s\'"]+', # Full URLs r'wx\.request\s*\(\s*\{[^}]+url\s*:\s*[\'"]([^\'"]+)', r'url\s*:\s*[\'"]([^\'"]+)[\'"]', # Generic URL assignments r'/api/[a-zA-Z0-9/_-]+', # API path fragments r'baseURL\s*:\s*[\'"]([^\'"]+)[\'"]', # Base URL configs ] for root, dirs, files in os.walk(source_dir): for file in files: if not file.endswith(('.js', '.json')): continue filepath = os.path.join(root, file) try: with open(filepath, 'r', encoding='utf-8', errors='ignore') as f: for line_num, line in enumerate(f, 1): for pattern in patterns: for match in re.finditer(pattern, line): endpoints.append({ 'pattern': pattern, 'value': match.group(0), 'file': filepath, 'line': line_num, 'context': line.strip() }) except Exception as e: continue return endpoints if __name__ == '__main__': import sys source_dir = sys.argv[1] output_file = sys.argv[2] results = extract_endpoints(source_dir) with open(output_file, 'w', encoding='utf-8') as f: json.dump(results, f, indent=2, ensure_ascii=False) ``` ### Secret Scanner Script Located at `tools/scripts/secret_scanner.py`: ```python import re import json import os SECRET_PATTERNS = { 'api_key': r'(?i)(api[_-]?key|apikey|key)\s*[:=]\s*[\'"]([a-zA-Z0-9_\-]{16,})[\'"]', 'access_token': r'(?i)(access[_-]?token|accesstoken)\s*[:=]\s*[\'"]([a-zA-Z0-9_\-\.]{20,})[\'"]', 'secret': r'(?i)(secret|app[_-]?secret)\s*[:=]\s*[\'"]([a-zA-Z0-9_\-]{16,})[\'"]', 'password': r'(?i)(password|passwd|pwd)\s*[:=]\s*[\'"](.{6,})[\'"]', 'private_key': r'-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----', 'ip_internal': r'\b(?:10|172\.(?:1[6-9]|2[0-9]|3[01])|192\.168)\.\d{1,3}\.\d{1,3}\b', 'phone': r'(?<![0-9])(1[3-9]\d{9})(?![0-9])', 'id_card': r'[1-6]\d{5}(?:19|20)\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])\d{3}[\dXx]', 'email': r'\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b', 'debug_flag': r'(?i)(debug|test|dev)[_-]?(mode|flag|env)\s*[:=]\s*(true|1|yes)', } def scan_secrets(source_dir): """ Scan for sensitive information in source files. Returns: List of findings with {type, value, file, line, context} """ findings = [] for root, dirs, files in os.walk(source_dir): for file in files: if not file.endswith(('.js', '.json', '.xml')): continue filepath = os.path.join(root, file) try: with open(filepath, 'r', encoding='utf-8', errors='ignore') as f: for line_num, line in enumerate(f, 1): for secret_type, pattern in SECRET_PATTERNS.items(): for match in re.finditer(pattern, line): findings.append({ 'type': secret_type, 'value': match.group(0), 'file': filepath, 'line': line_num, 'context': line.strip(), 'severity': classify_severity(secret_type) }) except Exception as e: continue return findings def classify_severity(secret_type): """Assign severity based on secret type.""" critical = ['private_key', 'secret', 'api_key'] high = ['access_token', 'password'] medium = ['ip_internal', 'debug_flag'] if secret_type in critical: return 'CRITICAL' elif secret_type in high: return 'HIGH' elif secret_type in medium: return 'MEDIUM' return 'LOW' if __name__ == '__main__': import sys source_dir = sys.argv[1] output_file = sys.argv[2] results = scan_secrets(source_dir) with open(output_file, 'w', encoding='utf-8') as f: json.dump(results, f, indent=2, ensure_ascii=False) ``` ## Agent Configuration ### Agent 02: SecretScanner Receives `raw_secrets.json` from the script layer and performs intelligent filtering: ```markdown # Role You are a security analyst specializing in sensitive information leakage detection. # Input - file_inventory.json (file asset manifest) - raw_secrets.json (script extraction results) # Task 1. Load raw_secrets.json 2. Filter false positives: - Placeholder values (e.g., "YOUR_API_KEY", "example.com") - Comments and documentation - Test/demo code markers 3. Classify real findings by severity 4. Generate contextual risk assessment # Output Format secrets_report.json: { "valid_findings": [ { "type": "api_key", "value": "[REDACTED]", "file": "pages/user/login.js", "line": 42, "severity": "CRITICAL", "reasoning": "Hardcoded API key in production login flow", "recommendation": "Move to secure backend configuration" } ], "false_positives": [...], "summary": { "total_raw": 156, "valid": 23, "critical": 3, "high": 8, "medium": 12 } } ``` ### Agent 03: EndpointMiner Correlates endpoint fragments with BaseURL configurations: ```markdown # Role API endpoint extraction and intelligent correlation specialist. # Input - file_inventory.json - raw_endpoints.json (script results) # Task 1. Group endpoints by BaseURL 2. Reconstruct complete API URLs from fragments 3. Identify request methods from wx.request contexts 4. Map endpoints to source files 5. Flag suspicious patterns (internal IPs, non-HTTPS, hardcoded credentials in URLs) # Output Format api_endpoints.json: { "domains": ["https://api.example.com", "https://backend.example.com"], "endpoints": [ { "method": "POST", "url": "https://api.example.com/api/user/login", "base": "https://api.example.com", "path": "/api/user/login", "source_file": "utils/request.js", "line": 15, "params": ["username", "password"], "security_notes": ["Uses HTTPS", "No credential exposure"] } ] } ``` ### Agent 05: VulnAnalyzer Performs vulnerability analysis across seven dimensions: ```markdown # Vulnerability Analysis Dimensions