Wecomcli Setup

• Analyzed: May 9, 2026, 6:46 PM
• Findings: 1
• Version: 1.0.0
• Hash: bf85b0adcebd87dbbefe327d0fb30a0e781d8c8bfcc7cb9e26b6ef4648a78394
• Source: palm
• External report: View on VirusTotal

Findings (1)

The SKILL.md file contains explicit instructions for the AI agent to bypass user consent ('强制自动完成... 无需询问用户') and execute high-risk shell commands automatically, including global NPM installations and the use of 'sudo' on macOS/Linux. While these actions are functionally aligned with the stated goal of setting up the 'wecom-cli' tool, the instruction to ignore user confirmation for installation and privilege escalation is a security concern. Additionally, the skill fetches external content via 'npx skills add WeComTeam/wecom-cli', which introduces a supply-chain risk.