Wxmini Security Audit

# wxmini-security-audit

> Skill by [ara.so](https://ara.so) — Security Skills collection.

Automated security auditing framework for WeChat mini-programs using Claude Code Agent Teams. Orchestrates 7 specialized agents to perform comprehensive static analysis covering sensitive information leakage, API endpoint extraction, cryptographic analysis, and vulnerability detection across seven security dimensions.

## What It Does

- **Multi-Agent Orchestration**: Coordinates 7 specialized agents (decompiler, secret scanner, endpoint miner, crypto analyzer, vulnerability analyzer, custom analyzer, reporter)
- **Dual-Layer Architecture**: Python regex scripts ensure 100% rule coverage, LLM agents provide intelligent analysis with context awareness
- **Parallel Phase 2 Execution**: Runs 4 analysis agents simultaneously to minimize audit time
- **User Intent Parsing**: Automatically triggers deep custom analysis when specific endpoints/parameters are mentioned
- **Pure Static Analysis**: Zero network requests, no attack code generation, fully local processing
- **Comprehensive Reporting**: Generates both summary reports and detailed documentation with structured data exports

## Architecture

The framework operates in sequential phases:

1. **Phase 0**: User intent parsing (extracts target path, creates output directory, parses requirements)
2. **Phase 1**: Decompilation (unveilr.exe processes wxapkg files, generates file inventory)
3. **Phase 1.5**: Script pre-scanning (Python regex extracts raw endpoints and secrets)
4. **Phase 2**: Parallel analysis (4 agents run simultaneously: SecretScanner, EndpointMiner, CryptoAnalyzer, VulnAnalyzer)
5. **Phase 2.5**: Custom analysis (triggered only when user specifies particular endpoints/parameters)
6. **Phase 3**: Report generation (aggregates findings into structured reports)

## Installation

### Prerequisites

- Claude Code CLI environment with Agent Teams/Skill support
- Python 3.x (standard library only, no external dependencies)
- Windows platform (current version requires unveilr.exe)
- unveilr.exe binary (WeChat mini-program decompiler)

### Setup

Clone the repository into your Claude Code Skills directory:

```bash
git clone https://github.com/sssmmmwww/wxmini-security-audit.git
cd wxmini-security-audit
```

Obtain `unveilr.exe` from the [unveilr project](https://github.com/nicholaschan23/unveilr) and place it in the `tools/` directory:

```
wxmini-security-audit/
├── SKILL.md
├── agents/
│   ├── agent-01-decompiler.md
│   ├── agent-02-secret-scanner.md
│   ├── agent-03-endpoint-miner.md
│   ├── agent-04-crypto-analyzer.md
│   ├── agent-05-vuln-analyzer.md
│   ├── agent-06-reporter.md
│   └── agent-07-custom-analyzer.md
└── tools/
    ├── unveilr.exe          # Place here
    └── scripts/
        ├── endpoint_extractor.py
        └── secret_scanner.py
```

## Usage

### Basic Audit

Trigger the audit by providing a mini-program directory path:

```
Audit this WeChat mini program D:\wechat\miniapp\wxapkg_files
```

```
Analyze this mini program for security issues C:\miniprogram\target
```

### Focused Analysis

Specify particular concerns to trigger Phase 2.5 custom analysis:

```
Audit this mini program D:\wxapp, focus on the /api/user/login endpoint
```

```
Scan D:\wxapp for vulnerabilities, particularly payment security and privilege escalation
```

### With External Tool Integration

Provide conte