OpenClaw WeChat Setup
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill appears to be a straightforward WeChat setup guide, but it relies on running an unpinned external npm installer and authorizing a WeChat account.
Install this only if you intend to connect WeChat to OpenClaw. Run the installer in a trusted terminal, verify the npm package/source if possible, scan only with the intended WeChat account, and consider enabling per-account context isolation for multiple accounts.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The installer could change behavior over time as the npm package updates.
The setup depends on downloading and running the latest external npm CLI. This is central to the skill purpose, but the package code and exact version are not included in the provided artifacts.
npx -y @tencent-weixin/openclaw-weixin-cli@latest install
Run it only if you trust the package source; prefer official documentation or a pinned version when possible.
Running the command can alter OpenClaw configuration and activate a new messaging channel.
The documented installer mutates the local OpenClaw environment and starts an authorization flow. These actions are disclosed and aligned with setup, but they are still impactful local changes.
Download and install the `@tencent-weixin/openclaw-weixin` plugin ... Enable the plugin in OpenClaw config ... Start the WeChat QR code login flow
Confirm the target OpenClaw installation before running the command and review the resulting channel/plugin status afterward.
The connected WeChat account can become a messaging channel for OpenClaw.
The skill requires the user to authorize a WeChat account for use as an OpenClaw channel. This is expected for the integration and requires user scanning.
The user must scan it with their WeChat mobile app to authorize the connection.
Scan only with the intended WeChat account and remove or re-authenticate accounts if you no longer want them connected.
If multiple WeChat accounts are linked, conversation context handling may affect privacy between accounts.
The skill acknowledges conversation-context isolation for multiple WeChat accounts. This is disclosed and optional, but users should notice the context boundary setting.
To isolate conversation context per WeChat account: `openclaw config set agents.mode per-channel-per-peer`
Enable per-channel-per-peer mode when using multiple accounts or when conversations should remain separated.