Security audit
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent WeChat channel plugin that uses stored login state to send and receive WeChat messages as documented.
Install only if you want OpenClaw to operate a WeChat bot account. Treat the OpenClaw state directory as sensitive because it stores bot tokens and context tokens that enable replies and scheduled/direct sends; do not share those files. Be aware that media sends may upload local files or fetched remote media to WeChat/CDN services.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.