WeChat Send

Automate sending text messages in the macOS WeChat desktop app by controlling the UI via AppleScript and JXA. This is NOT a WeChat chat channel for OpenClaw...

This skill is coherent with its stated purpose of GUI-automating WeChat on macOS, but check these before installing: (1) Correct the Accessibility guidance — grant permission to the app/process that will run the script (Terminal, your agent gateway, or node only if you actually run it via node), not 'node' by default. (2) The script overwrites your clipboard with the message and does not restore it; modify the script to save/restore the previous clipboard if that matters to you. (3) GUI automation can send input to the wrong contact if search results are ambiguous — test with a non-sensitive dummy contact first. (4) Only grant Accessibility to trusted processes and consider running the script in a controlled environment. If you want higher assurance, ask the author to (a) fix the node/accessibility documentation mismatch, (b) add logic to save and restore the clipboard, and (c) optionally confirm which host/process is expected to run the commands.

Type: OpenClaw Skill Name: wechat-send Version: 1.0.0 The skill is vulnerable to AppleScript injection because the `$CONTACT` and `$MESSAGE` variables are directly interpolated into `osascript` command strings in `scripts/wechat_send.sh` without sanitization. While the script functions as described for UI automation, it requires granting high-privilege macOS Accessibility permissions to the `node` process, which could be abused if the agent is compromised. No evidence of intentional malice or data exfiltration was found.