wechat-auto-reply

ReviewAudited by ClawScan on May 10, 2026.

Overview

This skill is openly designed to read WeChat chats and send messages from your account, but its automatic-send path and external unreviewed installer deserve careful review before use.

Install only if you are comfortable with a tool reading WeChat conversations and sending messages from your account. Review the external Homebrew package first, test with a low-risk contact, and consider changing the workflow so every message requires confirmation.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A mistaken OCR result, wrong contact selection, or bad reply rule could send an unintended message from your WeChat account.

Why it was flagged

The skill documents a workflow that automatically sends WeChat messages based on OCR and confidence scoring without user confirmation in the high-confidence branch.

Skill content
置信度 > 85% → 自动发送 ... 点击输入框获取焦点 ... 粘贴回复内容 ... 按回车发送
Recommendation

Use only with contacts where automatic replies are acceptable; ideally require confirmation before every send, preview the target/contact/message, and add an allowlist or dry-run mode.

What this means

Messages sent by the tool will appear to recipients as if you sent them yourself.

Why it was flagged

The skill uses the local logged-in WeChat application and sends messages under the user's existing WeChat identity.

Skill content
tell application "WeChat" to activate ... 搜索联系人 → 直接发送指定消息
Recommendation

Verify the active WeChat account and contact before use, and avoid granting automation permissions on shared or unintended accounts.

What this means

Private WeChat conversation text is processed locally by the automation flow and may be shown in confirmation dialogs.

Why it was flagged

The workflow reads chat content from screenshots and may display the full recognized conversation for confirmation.

Skill content
OCR 识别聊天内容 ... 低置信度时会显示完整聊天内容和建议回复
Recommendation

Avoid using it on highly sensitive chats unless you have reviewed how screenshots/OCR output are stored, logged, or discarded.

What this means

The actual installed command that controls WeChat is outside the provided scan context, so its implementation and updates were not verified here.

Why it was flagged

The reviewed artifact is instruction-only, but the documented setup pulls runnable code and dependencies from an external Homebrew tap.

Skill content
brew install bjdzliu/openclaw/wechat-auto-reply ... 安装所有依赖(`cliclick`, `python@3`, `pyobjc`) ... 创建全局命令 `wechat-auto-reply`
Recommendation

Review the Homebrew formula and installed scripts before running, prefer pinned versions, and install only from a source you trust.