Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
企业微信快速集成配置
v1.0.0企业微信快速集成配置 - 5分钟连接 OpenClaw 与企业微信，解锁群机器人、应用消息、客户管理。适合：企业用户、微信生态、客户服务。
⭐ 0· 114·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to be a quick integration guide for 企业微信 and the described steps (CorpId, AgentId, Secret, webhooks, callback URLs) match that purpose. However, the metadata only declares 'curl' as a required binary while the runtime instructions require the 'openclaw' CLI and editing ~/.openclaw/config.yml; the config path and openclaw binary are not declared. That mismatch is an inconsistency: a legitimate quickstart should declare the tool(s) it expects to run and any config files it will modify.
Instruction Scope
The SKILL.md instructs the user to edit ~/.openclaw/config.yml to store CorpId/AgentId/Secret and to run 'openclaw gateway restart'. Those actions are in-scope for configuring an integration, but the instructions assume write access to a user config file and execution of the 'openclaw' binary. The guide also includes curl examples and webhook POSTs to the official qyapi.weixin.qq.com endpoints only (which is expected).
Install Mechanism
This is an instruction-only skill with no install spec and no code to download or execute. That minimizes installation risk because nothing will be written or executed by the skill itself.
Credentials
No environment variables or credential fields are declared in the skill metadata, yet the guide instructs storing secrets (Agent Secret, optional Customer Secret) in the OpenClaw config file. The skill does not declare required config paths (it references ~/.openclaw/config.yml) nor recommend safer secret storage (env vars or secret manager). Storing plaintext secrets in a config file is common but should be explicitly declared and the security implications noted.
Persistence & Privilege
The skill is user-invocable, not always-installed, and allows model invocation (platform defaults). It does not request elevated persistence or to modify other skills or global agent settings. No privilege escalation indicators are present.
What to consider before installing
This skill appears to be a legitimate how-to for connecting OpenClaw to 企业微信, but it has several mismatches you should consider before using it:
- Verify local tooling: the instructions expect the 'openclaw' CLI and a ~/.openclaw/config.yml file, but the skill metadata only lists 'curl'. Confirm you have the openclaw binary and that running 'openclaw gateway restart' is safe in your environment.
- Backup before changing things: back up ~/.openclaw/config.yml (or your OpenClaw configuration) before adding secrets so you can restore if needed.
- Secrets handling: the guide tells you to place application secrets in the config file. Prefer storing secrets in a secure secret manager or environment variables if your platform supports them, or ensure file permissions restrict access (e.g., chmod 600). The skill does not declare or enforce any secret-handling policy.
- Endpoint sanity: webhook and API endpoints referenced are the official企业微信 (qyapi.weixin.qq.com) endpoints; still validate any webhook keys/URLs you paste and test with non-production accounts first.
- Source provenance: the skill source and homepage are unknown and the owner ID is not a recognized upstream. If this will be used in production, ask the publisher for a trustworthy source or official docs, or prefer official OpenClaw/WeCom documentation.
If you proceed: make a config backup, verify binaries and permissions, and use test credentials or restricted accounts until you're comfortable with the integration.Like a lobster shell, security has layers — review code before you run it.
chinesevk976beprp77f38kc7cy19qyz31838ggfenterprisevk976beprp77f38kc7cy19qyz31838ggflatestvk976beprp77f38kc7cy19qyz31838ggfwecomvk976beprp77f38kc7cy19qyz31838ggf
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
企 Clawdis
Binscurl