ClawHub
Back to skill

Security audit

企业微信对话配置

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward WeCom setup guide with disclosed credential and plugin configuration steps, not hidden or destructive behavior.

Install only if you intend to trust the @wecom/wecom-openclaw-plugin package, keep the WeCom bot secret protected, and prefer allowlist or pairing policies instead of the open sample configuration when the bot should be limited to specific users or groups.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.