Wechat Send

Send a message to a contact or group via macOS WeChat desktop client. Use when the user asks to send a WeChat message, message someone on WeChat, or reply to...

This skill appears to do what it says: automate the macOS WeChat desktop UI to send messages. Before installing, consider: (1) You must grant Accessibility permissions and have WeChat logged in. (2) The script saves screenshots and a temporary clipboard file under /tmp (e.g., /tmp/wechat_search_dropdown.png, /tmp/wechat_verify_title.png, /tmp/wechat_send_clip.txt); these may contain sensitive text and are readable by other local users/processes — clean them if needed. (3) Installation uses Homebrew's cliclick (standard). (4) If you want to limit risk, review the provided script yourself and run it in a controlled environment, and avoid giving the agent autonomous ability to run the skill if you prefer manual control.

Type: OpenClaw Skill Name: wechat-send-cn Version: 2.0.1 The skill automates the macOS WeChat desktop client using high-risk capabilities including UI automation (cliclick), keystroke injection (osascript), and screen capture (screencapture), which require Accessibility permissions. While these behaviors are aligned with the stated purpose of sending messages, they constitute a significant attack surface. The script (scripts/wechat_send.sh) uses temporary files in /tmp to store message content and screenshots, which could lead to sensitive data exposure. No evidence of intentional malice, data exfiltration, or prompt injection was found, but the reliance on high-privilege automation tools and local file storage for sensitive data warrants a suspicious classification.