Back to skill
Skillv0.1.0
ClawScan security
Wecom Channel Fix · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 11, 2026, 4:47 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's instructions, file and command access, and no-install/no-credential footprint are consistent with a local troubleshooting tool for a WeCom channel, but the source is unspecified so exercise caution before running changes.
- Guidance
- This skill is coherent for debugging and repairing a WeCom channel: it reads ~/.openclaw/openclaw.json and /tmp logs, suggests edits, makes a backup (cp) and restarts the gateway. Before running any automated fixes: 1) manually review and back up your config (the SKILL.md already recommends this); 2) verify the plugin ID/name change exactly matches the plugin's exported id to avoid breaking the gateway; 3) be aware that botId/secret values are sensitive — do not paste them into untrusted tooling or public locations; 4) the skill's source/homepage appears to use a placeholder (YOUR_USERNAME) and the repository/origin is unclear — prefer running the suggested commands yourself or confirming the repo/author before allowing an agent to apply automatic fixes. If you want higher assurance, request the actual repository or a signed/known author before installation.
Review Dimensions
- Purpose & Capability
- okThe name/description (WeCom channel diagnosis & repair) match the SKILL.md steps: reading channel status, config, plugin entries, logs, and providing concrete edits and restart steps. Nothing requested (no env vars, no installs) is out-of-band for that purpose.
- Instruction Scope
- noteInstructions explicitly tell the agent to read local OpenClaw config (~/.openclaw/openclaw.json), temporary logs (/tmp/openclaw/openclaw-YYYY-MM-DD.log), and run OpenClaw CLI commands (openclaw config/get/set, channels status, gateway restart). This is appropriate for diagnosing and fixing the channel, but it does mean the skill will (if executed) access and modify local config files and view logs — actions that can expose secrets (botId/secret) and can cause service disruption if applied incorrectly.
- Install Mechanism
- okInstruction-only skill with no install spec, no downloads, and no code files — lowest install risk.
- Credentials
- okThe skill declares no required environment variables or credentials. The SKILL.md asks the operator to provide botId/secret when configuring, but does not request or store external credentials itself. Access to local config and logs is proportional to the task.
- Persistence & Privilege
- okalways is false and the skill does not request persistent system presence or modify other skills' configs. It instructs the user/agent to edit only OpenClaw config files and restart the gateway, which is appropriate for the stated purpose.