skyline-scroll-api

github.com/wechat-miniprogram/skyline-skills
Verdict: Proceed with caution
0 critical0 high7 medium
C
SCORE 55 / 100
$skillox install skyline-scroll-apiSoon
Sign in to followFollowing emails you when a re-scan drops the grade. Opt-out is per-creator on /account/billing.

Why grade C?

score · 55 / 100

The current grade reflects 7 medium findings (6+ MEDs → C).

0 CRIT0 HIGH7 MED0 LOW
To reach a higher grade
  • B
    Reach Btarget score 75

    Resolve 2 of 7 MED (cap is 5).

  • A
    Reach Atarget score 95

    Resolve 5 of 7 MED (cap is 2).

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Latest scan findings

Scan crawl-ofd81q7100rtfu2b3flsup6a · Thu, 28 May 2026 17:54:18 GMT · 2ms

med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 31CWE-78
▾
29// ScrollViewContext（需开启 enhanced）
30wx.createSelectorQuery().select('#scrollview').node()
31 .exec(res => { const ctx = res[0].node })← spawns a subprocess outside declared capabilities
32
33// DraggableSheetContext
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 35CWE-78
▾
33// DraggableSheetContext
34wx.createSelectorQuery().select('.sheet').node()
35 .exec(res => { const ctx = res[0].node })← spawns a subprocess outside declared capabilities
36
37// worklet.scrollViewContext（通过 ref）
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 40CWE-78
▾
38this.scrollRef = wx.worklet.shared()
39this.createSelectorQuery().select('.scrollable')
40 .ref(res => { this.scrollRef.value = res.ref }).exec()← spawns a subprocess outside declared capabilities
41```
42
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 84CWE-78
▾
82 // ❌ 错误：使用 node() 而非 ref()
83 this.createSelectorQuery().select('.scroll').node()
84 .exec(res => { /* 这是 ScrollViewContext，不是 worklet 引用 */ })← spawns a subprocess outside declared capabilities
85
86 // ✅ 正确：使用 ref() + shared()
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 89CWE-78
▾
87 this.scrollRef = wx.worklet.shared()
88 this.createSelectorQuery().select('.scroll')
89 .ref(res => { this.scrollRef.value = res.ref }).exec()← spawns a subprocess outside declared capabilities
90 ```
91
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 152CWE-78
▾
150```js
151// 获取 ScrollViewContext
152wx.createSelectorQuery().select('#sv').node().exec(res => {← spawns a subprocess outside declared capabilities
153 const ctx = res[0].node
154 ctx.triggerRefresh({ duration: 300 })
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
View latest scan →
skillox.io/c/skyline-scroll-api