Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
WeChat Work Notifier
v1.0.0微信（WeChat Work / 企业微信）消息通知 Skill。 通过企业微信群机器人的 Webhook 接口向微信群/微信用户发送消息通知。 支持：文本消息、Markdown、卡片消息、图片。 适用场景：定时报告、报警通知、交易信号推送、自动化工作流通知。
⭐ 1· 75·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the code and instructions: the package sends messages to WeChat Work group webhooks (text, markdown, card, image). However the registry metadata lists no required environment variables or primary credential, while the SKILL.md and code clearly expect a WECHAT_WEBHOOK_URL — this is an inconsistency in declared requirements.
Instruction Scope
SKILL.md instructions and the code are narrowly scoped to constructing webhook payloads and POSTing them to the provided qyapi.weixin.qq.com webhook URL. The instructions only reference installing requests and setting WECHAT_WEBHOOK_URL; they do not ask the agent to read unrelated files, other env vars, or forward data to unexpected endpoints.
Install Mechanism
No install spec provided (instruction-only), and the included setup script only runs 'pip install requests' if missing. There are no downloads from third‑party URLs, no archive extraction, and no creation of non-standard system binaries.
Credentials
The skill requires a sensitive secret-like value (WECHAT_WEBHOOK_URL) to post messages, but the registry metadata did not declare any required env vars or primary credential. This mismatch could cause users to overlook the need to provide the webhook URL or to misunderstand what secrets the skill needs. Otherwise, the only environment access the code uses is the single webhook URL.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system-wide configuration, and does not persist credentials beyond reading WECHAT_WEBHOOK_URL from the environment. Autonomous invocation is enabled by default but is not combined with elevated privileges here.
What to consider before installing
This skill's functionality is coherent with its description (it POSTs messages to a WeChat Work webhook), but the package metadata omitted the required WECHAT_WEBHOOK_URL environment variable. Before installing: (1) verify you have a valid webhook URL and set it only in a secure place (do not commit to git); (2) review the included wechat_notify.py (it only posts to the webhook URL and uses requests); (3) understand that any holder of the webhook URL can post messages to your group — treat it like a secret and rotate it if exposed; (4) run the code in a trusted environment and inspect network traffic if you want to confirm it only contacts qyapi.weixin.qq.com. If you maintain the registry entry, update the metadata to declare WECHAT_WEBHOOK_URL as a required credential to remove the inconsistency.Like a lobster shell, security has layers — review code before you run it.
latestvk97b2ka22q2te8hh93arhm6e0x83kksh
License
MIT-0
Free to use, modify, and redistribute. No attribution required.