📦

wecom-unified

Name: wecom-unified
Author: wecomteam

مراجعة المحتوى r1 مخاطر عالية ⚙️ الأوامر الخارجية📁 الوصول إلى نظام الملفات🌐 الوصول إلى الشبكة🔑 متغيرات البيئة

Manage WeCom work from one workflow

WeCom work is spread across documents, schedules, meetings, files, and messages. This skill routes authorized requests to the correct WeCom CLI workflow with documented parameters and safeguards.

يدعم: Claude Codex Code(CC)

⚠️ 38 ضعيف

توقف واطلب التأكيد قبل التثبيت.

راجع الخطة واحصل على موافقة صريحة من المستخدم قبل تغيير الملفات.

التثبيت باستخدام Agent لدي

انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.

طلب الوكيل

Review the Skillstore skill "wecom-unified" from https://skillstore.io/skills/wecomteam-wecom-unified.md and its manifest at https://skillstore.io/api/skills/wecomteam-wecom-unified/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.

موارد مهيّأة لـ Agents

استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.

تفاصيل Markdown GET /skills/wecomteam-wecom-unified.md manifest موقَّع GET /api/skills/wecomteam-wecom-unified/manifest lockfile موقَّع GET /api/skills/wecomteam-wecom-unified/lockfile

اختبرها

جارٍ استخدام "wecom-unified". Schedule a review with Chen Yu tomorrow at 10:00.

النتيجة المتوقعة:

I found one matching contact: Chen Yu.
The schedule is ready for confirmation: Review, tomorrow 10:00 to 10:30, Chen Yu.

جارٍ استخدام "wecom-unified". Create a smart table for weekly project status.

النتيجة المتوقعة:

Created a smart table for weekly project status.
It includes fields for project name, owner, status, update date, and notes.

جارٍ استخدام "wecom-unified". Send the latest report to my active work chat.

النتيجة المتوقعة:

I found the latest report in the authorized file space.
The report was sent to your active work chat.

التدقيق الأمني

مخاطر عالية

v2 • ١٨‏/٨‏/٢٠٢٦ فتح التقرير المرتبط بالإصدار

Most static findings are false positives caused by multilingual documentation, Markdown code formatting, example URLs, and defensive file-handling code. The audit identified one material workflow risk: the skill can automatically install an unpinned global npm package without user confirmation. No prompt-injection language, credential exfiltration, or concealed executable payload was found in the reviewed evidence.

الملفات التي تم فحصها

21,712

الأسطر التي تم تحليلها

عناصر المراجعة

تم تجاهل الإيجابيات الكاذبة

مخاوف أمنية مؤكدة (1)

مرتفع

SKILL.md:19-23

Unpinned Global Package Installation Without Confirmation

The skill directs the agent to run `npm install -g @wecom/cli` whenever the CLI is missing or outdated, without requiring user confirmation or pinning a version. This can introduce a supply-chain change with global system impact before the requested business action begins.

The installation instruction is explicit and unconditional after a missing or old CLI check. A global, unpinned package install is externally sourced and changes the local environment.

عوامل الخطر

⚙️ الأوامر الخارجية (50)

📁 الوصول إلى نظام الملفات (8)

references/wecomcli-disk.md:207 references/wecomcli-media.md:55 references/wecomcli-smartpage.md:77 references/wecomcli-smartsheet-common.md:12 references/wecomcli-smartsheet-formula.md:502 scripts/build_docx.py:512 scripts/build_docx.py:525 scripts/build_docx.py:586

🌐 الوصول إلى الشبكة (10)

references/wecomcli-smartpage-edit.md:128 references/wecomcli-smartpage-mdx-syntax.md:113 references/wecomcli-smartpage-mdx-syntax.md:660 references/wecomcli-smartsheet-record-values.md:105 references/wecomcli-smartsheet-record-values.md:116 references/wecomcli-smartsheet-webhook-examples.md:128 references/wecomcli-smartsheet-webhook-examples.md:146 SKILL.md:77 SKILL.md:89 SKILL.md:125

🔑 متغيرات البيئة (1)

scripts/build_docx.py:484

دقّقه: claude عرض سجل التدقيق →

شارك واستشهد بهذا التقرير

شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.

فتح التقرير المرتبط بالإصدار

نسخ رابط التقرير

https://skillstore.io/skills/wecomteam-wecom-unified/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

شارة Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/wecomteam-wecom-unified/security.svg)](https://skillstore.io/skills/wecomteam-wecom-unified?utm_source=security_passport_badge)

شارة HTML

<a href="https://skillstore.io/skills/wecomteam-wecom-unified?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wecomteam-wecom-unified/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

بطاقة قابلة للتضمين

<iframe src="https://skillstore.io/embed/skills/wecomteam-wecom-unified.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

الاستشهادات الأكاديمية (APA · BibTeX · CFF)

اقتباس APA

wecomteam. (2026). wecom-unified security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wecomteam-wecom-unified/audits/2

اقتباس BibTeX

@techreport{wecomteam-wecomteam-wecom-unified-2026,
  author = {wecomteam},
  title = {wecom-unified security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/wecomteam-wecom-unified/audits/2},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wecom-unified security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
  - name: "wecomteam"
date-released: "2026-08-18"
url: "https://skillstore.io/skills/wecomteam-wecom-unified/audits/2"
identifiers:
  - type: other
    value: "skillstore:wecomteam-wecom-unified:audit:2"
    description: "Skillstore immutable audit report identifier"

تقييم Skillstore

سبب هذا التقييم موثوقية الأدلة: متوسط

الهندسة المعمارية

قابلية الصيانة

المحتوى

المجتمع

الامتثال للمواصفات

ما الذي يمكنك بناؤه

Coordinate a project meeting

Check participant availability, select a bookable room, and create an authorized meeting or schedule.

Maintain team records

Create or update approved documents, online tables, and smart tables for operational work.

Handle workplace communications

Search authorized email and files, then send a message or email through the configured account.

جرّب هذه الموجّهات

Find a colleague

Find the authorized WeCom contact named Li Ming and show the available matching names.

Create a schedule

Schedule a 30-minute planning session with Chen Yu tomorrow afternoon. Ask me if the time is ambiguous.

Update a smart table

In this WeCom smart table, add a record for Project Atlas with status In Progress and owner Wang Lei.

Prepare a meeting

Find a one-hour time next week when Chen Yu and Wang Lei are free, then propose available meeting rooms before creating anything.

أفضل الممارسات

Confirm the target, scope, and key parameters before irreversible changes or external sends.
Use a current-message link or an authorized search result to identify documents and tables.
Review names, times, recipients, and attachments before creating meetings or sending communications.

تجنب

Do not request or expose internal identifiers when readable names or links are available.
Do not assume a missing or ambiguous person, document, room, or time selection.
Do not rely on this skill for operations that the WeCom CLI or account permissions do not support.