OpenClaw WeChat Setup

Install and connect the WeChat (微信) channel plugin for OpenClaw. Use when the user asks to set up WeChat, connect WeChat, install the WeChat plugin, scan WeC...

This skill appears to do what it says: it tells you to install a WeChat plugin for OpenClaw and to scan a QR to link an account. Before running the provided commands, consider these precautions: - Verify you have the openclaw CLI installed and working. - Inspect the npm package (https://www.npmjs.com/package/@tencent-weixin/openclaw-weixin-cli or the package's GitHub repo) before running npx, and prefer a pinned version rather than '@latest' if you want repeatability. - Be aware that npx executes code downloaded from the npm registry; run it in a trusted or isolated environment (not as root) if you have concerns. - After installation, check OpenClaw plugin settings and logs to confirm expected behavior and revoke access if unexpected activity occurs. - If you want higher assurance, obtain the plugin from an official OpenClaw or Tencent repository and validate its source code/maintainer identity before installing.

Type: OpenClaw Skill Name: openclaw-weixin-setup Version: 1.0.0 The skill bundle instructs the AI agent to execute `npx -y @tencent-weixin/openclaw-weixin-cli@latest install` in SKILL.md, which downloads and runs remote code from an unverified npm scope. This presents a significant supply chain risk, as the scope name (@tencent-weixin) mimics official branding but its legitimacy cannot be verified within the bundle. While the behavior aligns with the stated goal of installing a WeChat plugin, the use of npx for automated installation of remote artifacts is a high-risk pattern often used in supply chain attacks.