wecom-meeting
PassAudited by ClawScan on May 1, 2026.
Overview
This skill appears to do what it says—manage Enterprise WeChat meetings—but it uses company API credentials and can create or cancel meetings.
Install only if you want the agent to manage Enterprise WeChat meetings. Use a dedicated WeCom app Secret with minimal meeting permissions, keep `~/.wecom/config.json` private, confirm meeting details before creation or cancellation, and avoid force-canceling unless you are sure.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone using these credentials through the skill can act with the WeCom app's meeting permissions, including reading meeting information and creating or canceling meetings.
The code loads local Enterprise WeChat credentials and uses the app Secret to obtain an access token for the enterprise API.
config_path = Path.home() / ".wecom" / "config.json" ... "corpsecret": self.secret
Use a dedicated least-privilege WeCom application, grant only required meeting permissions, protect `~/.wecom/config.json`, and rotate the Secret if it is exposed.
A shared terminal log or agent transcript could reveal part of an access token if this test code is run directly.
If the API module is run directly, its test path prints part of the access token to stdout. This is not part of the normal helper-script flow, but token material should still be treated as sensitive.
print(f"✅ 成功获取 access_token: {token[:20]}...")Avoid running the module's direct test path in shared logs, and remove or suppress token output in production use.
Incorrect or unintended invocation could create unwanted meeting invitations or cancel a real meeting.
The skill performs mutating API calls to create and cancel meetings. This is the stated purpose, but it can affect company schedules and invitees.
url = f"{self.base_url}/meeting/create?access_token={access_token}" ... url = f"{self.base_url}/meeting/cancel?access_token={access_token}"Confirm the meeting title, time, attendees, user ID, and meeting ID before creation or cancellation; avoid `--force` unless the user explicitly approves.
A user or environment will fetch whatever `requests` version the package index resolves at install time.
The documented dependency installation is manual and unpinned. It is a standard, purpose-aligned HTTP dependency, but version/provenance is not fixed by an install spec.
pip3 install requests
Install from a trusted package source and consider pinning `requests` in controlled environments.