Weixin Runtime Fix

AdvisoryAudited by Static analysis on May 7, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If run, the skill changes how the installed Weixin plugin behaves and those changes remain until restored or reinstalled.

Why it was flagged

Running the helper executes local shell/Python commands that modify installed plugin JavaScript files. This is disclosed and central to the stated fix, but it is still local code execution with persistent effects.

Skill content
sed -i 's/setStatus: ctx.setStatus,$/...channelRuntime: ctx.channelRuntime,/' "$CHANNEL_JS" ... python3 << 'PYTHON_SCRIPT' ... sed -i '/Content-Length/d' "$API_JS"
Recommendation

Run the script only if you intentionally want this patch, review the file diffs first, and keep or verify the .bak backups before restarting OpenClaw.

What this means

Users have less upstream context for why this patch is trustworthy, which matters because it edits an installed messaging plugin.

Why it was flagged

The patcher has limited provenance and is not represented by a declarative install spec, even though the provided files are visible and no remote downloads are shown.

Skill content
Source: unknown; Homepage: none; No install spec — this is an instruction-only skill.
Recommendation

Inspect the provided script and compare the changes against the referenced issue or upstream plugin before applying it.