WeChat Auto Reply (V26 Safe)

Monitors a detached WeChat Mac window via OCR and automatically replies using a customizable AI persona with safety locks to prevent interference.

This package's code implements the WeChat auto-reply behavior described, but the registry metadata is incomplete: the SKILL.md and scripts require external CLIs (peekaboo, summarize, gemini), macOS Screen Recording and Accessibility permissions, and a Gemini API key that the dashboard asks you to enter. Before installing or running: - Verify the source and integrity of the external CLIs (peekaboo, summarize, gemini). The scripts will call them and those tools may send images/text to remote services. - Inspect dashboard.py to see how the API key is stored/used; avoid entering long-lived/high-privilege keys unless you confirm they are stored safely (the code likely writes to ~/.openclaw/workspace files). - Be aware the skill simulates keystrokes and manipulates the clipboard, which can send arbitrary text/files from your machine — test first with a throwaway WeChat account and minimal permissions. - If you need this functionality, consider creating an isolated macOS user account or VM for running it, use an ephemeral API key (least privilege), and verify the provenance of any third-party CLI binaries before use. Because required binaries and secret handling are not declared in the registry, treat this as suspicious until you confirm where the external tools come from and how the API key is protected.

Type: OpenClaw Skill Name: wechat-auto-reply-ai Version: 1.1.0 The skill bundle implements a WeChat auto-reply bot using high-risk capabilities such as screen capture, UI automation via AppleScript (osascript), and a local Flask web dashboard (dashboard.py). It contains several security vulnerabilities, most notably the extensive use of 'shell=True' in subprocess calls and 'os.system' for process management, which are susceptible to shell injection if target names or personas contain malicious characters. Furthermore, the dashboard listens on all network interfaces (0.0.0.0:5000) and handles sensitive Gemini API keys, potentially exposing the control interface and credentials to the local network. While these appear to be functional requirements or unintentional flaws rather than intentional malware, the combination of broad system permissions and weak input handling warrants a suspicious classification.