WeChat Work OpenClaw Adapter

Integrate WeChat Work (Enterprise WeChat) with OpenClaw for intelligent messaging. Enables receiving messages from WeChat Work, processing them with Claude A...

This adapter largely does what it claims (WeChat Work ↔ OpenClaw) but there are a few red flags you should consider before installing: - The registry metadata incorrectly states 'no required env vars' while the code requires multiple sensitive secrets (CORP_ID, AGENT_ID, AGENT_SECRET, APP_SECRET, WEBHOOK_TOKEN, OPENCLAW_TOKEN). Treat this as an inconsistency and verify the source/trustworthiness of the package before supplying credentials. - Inspect and (if you plan to run it) modify the code to ensure it does not log sensitive fields. The GET /webhook handler currently logs echostr and signatures; remove or sanitize such logs. - The security guide suggests filtering AI replies, but the runtime does not apply a filter before sending replies. Add filtering (or validate replies) to avoid accidental disclosure of secrets in responses. - getAccessToken falls back to AGENT_SECRET if APP_SECRET is missing — that is suspicious/incorrect behavior; ensure you set APP_SECRET correctly and consider changing the code to fail instead of using the wrong key. - The deploy instructions use cloudflared quick tunnels for convenience — do not use quick tunnels in production; prefer a stable named tunnel or proper hosting and add your server IP to WeChat Work’s trusted list as required. - Run this adapter in an isolated environment (dedicated user, limited network egress, local firewall rules), avoid exposing OpenClaw/API tokens broadly, and rotate credentials after testing. If you don't trust the publisher or cannot audit the code yourself, do not install or provide any production credentials. If you proceed, apply the logging sanitization and reply-filtering changes, and verify APP_SECRET behavior before putting it into production.

Type: OpenClaw Skill Name: wecom-openclaw Version: 1.0.0 The skill bundle provides a legitimate integration between WeChat Work (Enterprise WeChat) and OpenClaw. The core logic in `scripts/index.js` correctly implements WeChat's mandatory AES-256-CBC encryption/decryption and SHA1 signature verification protocols. The deployment script (`scripts/deploy.sh`) and documentation (`SKILL.md`, `security-guide.md`) are transparent, follow best practices for webhook handling (such as async replies to avoid timeouts), and contain no evidence of data exfiltration, unauthorized execution, or prompt injection attacks.