企业微信通知提醒

通过企业微信Webhook发送文本或Markdown消息，支持@指定用户，实现消息提醒与定时通知管理。

This skill appears to be what it says: a small shell script to send 企业微信 webhook messages. Before installing: 1) Treat your webhook key as a secret — avoid pasting it into scheduled task message strings or plaintext task descriptions because those may be stored or visible to others; prefer storing the key in a secure config or use a protected secret store if available. 2) Be aware the script calls curl with the key in the URL query parameter, which can be exposed in process listings or system logs on some hosts — accept that risk or use a more secure delivery method if needed. 3) The script optionally pipes the response to jq (if present) but only lists curl as a dependency; ensure jq is available if you want pretty printing. 4) Test with a non-production webhook key first. These are operational/privacy cautions, not indicators of malicious behavior.

Type: OpenClaw Skill Name: weixin-webhook Version: 1.1.0 The skill provides a utility for sending WeChat notifications but contains vulnerabilities in `send_weixin.sh`. The script lacks input sanitization, making it susceptible to JSON injection when constructing the API payload via string concatenation. Additionally, the practice of passing sensitive webhook keys as command-line arguments is insecure as it can expose credentials in system process listings. While these are likely unintentional coding flaws, they represent a lack of security best practices in handling external input and secrets.