技能 wecom-unified

📦

wecom-unified

Name: wecom-unified
Author: wecomteam

内容修订 r1 高风险 ⚙️ 外部命令📁 文件系统访问🌐 网络访问🔑 环境变量

Manage WeCom work from one workflow

WeCom work is spread across documents, schedules, meetings, files, and messages. This skill routes authorized requests to the correct WeCom CLI workflow with documented parameters and safeguards.

支持: Claude Codex Code(CC)

⚠️ 38 差

安装前请停下并请求确认。

请审查安装计划，并在更改文件前获得用户明确同意。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "wecom-unified" from https://skillstore.io/skills/wecomteam-wecom-unified.md and its manifest at https://skillstore.io/api/skills/wecomteam-wecom-unified/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/wecomteam-wecom-unified.md 已签名 manifest GET /api/skills/wecomteam-wecom-unified/manifest 已签名 lockfile GET /api/skills/wecomteam-wecom-unified/lockfile

测试它

正在使用“wecom-unified”。 Schedule a review with Chen Yu tomorrow at 10:00.

预期结果:

I found one matching contact: Chen Yu.
The schedule is ready for confirmation: Review, tomorrow 10:00 to 10:30, Chen Yu.

正在使用“wecom-unified”。 Create a smart table for weekly project status.

预期结果:

Created a smart table for weekly project status.
It includes fields for project name, owner, status, update date, and notes.

正在使用“wecom-unified”。 Send the latest report to my active work chat.

预期结果:

I found the latest report in the authorized file space.
The report was sent to your active work chat.

安全审计

高风险

v2 • 2026/8/18 打开版本化报告

Most static findings are false positives caused by multilingual documentation, Markdown code formatting, example URLs, and defensive file-handling code. The audit identified one material workflow risk: the skill can automatically install an unpinned global npm package without user confirmation. No prompt-injection language, credential exfiltration, or concealed executable payload was found in the reviewed evidence.

已扫描文件

21,712

分析行数

复核项

已忽略误报

已确认安全问题 (1)

高

SKILL.md:19-23

Unpinned Global Package Installation Without Confirmation

The skill directs the agent to run `npm install -g @wecom/cli` whenever the CLI is missing or outdated, without requiring user confirmation or pinning a version. This can introduce a supply-chain change with global system impact before the requested business action begins.

The installation instruction is explicit and unconditional after a missing or old CLI check. A global, unpinned package install is externally sourced and changes the local environment.

风险因素

⚙️ 外部命令 (50)

📁 文件系统访问 (8)

references/wecomcli-disk.md:207 references/wecomcli-media.md:55 references/wecomcli-smartpage.md:77 references/wecomcli-smartsheet-common.md:12 references/wecomcli-smartsheet-formula.md:502 scripts/build_docx.py:512 scripts/build_docx.py:525 scripts/build_docx.py:586

🌐 网络访问 (10)

references/wecomcli-smartpage-edit.md:128 references/wecomcli-smartpage-mdx-syntax.md:113 references/wecomcli-smartpage-mdx-syntax.md:660 references/wecomcli-smartsheet-record-values.md:105 references/wecomcli-smartsheet-record-values.md:116 references/wecomcli-smartsheet-webhook-examples.md:128 references/wecomcli-smartsheet-webhook-examples.md:146 SKILL.md:77 SKILL.md:89 SKILL.md:125

🔑 环境变量 (1)

scripts/build_docx.py:484

审计者: claude 查看审计历史 →

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/wecomteam-wecom-unified/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/wecomteam-wecom-unified/security.svg)](https://skillstore.io/skills/wecomteam-wecom-unified?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/wecomteam-wecom-unified?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wecomteam-wecom-unified/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/wecomteam-wecom-unified.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

wecomteam. (2026). wecom-unified security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wecomteam-wecom-unified/audits/2

BibTeX 引用

@techreport{wecomteam-wecomteam-wecom-unified-2026,
  author = {wecomteam},
  title = {wecom-unified security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/wecomteam-wecom-unified/audits/2},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wecom-unified security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
  - name: "wecomteam"
date-released: "2026-08-18"
url: "https://skillstore.io/skills/wecomteam-wecom-unified/audits/2"
identifiers:
  - type: other
    value: "skillstore:wecomteam-wecom-unified:audit:2"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Coordinate a project meeting

Check participant availability, select a bookable room, and create an authorized meeting or schedule.

Maintain team records

Create or update approved documents, online tables, and smart tables for operational work.

Handle workplace communications

Search authorized email and files, then send a message or email through the configured account.

试试这些提示

Find a colleague

Find the authorized WeCom contact named Li Ming and show the available matching names.

Create a schedule

Schedule a 30-minute planning session with Chen Yu tomorrow afternoon. Ask me if the time is ambiguous.

Update a smart table

In this WeCom smart table, add a record for Project Atlas with status In Progress and owner Wang Lei.

Prepare a meeting

Find a one-hour time next week when Chen Yu and Wang Lei are free, then propose available meeting rooms before creating anything.

最佳实践

Confirm the target, scope, and key parameters before irreversible changes or external sends.
Use a current-message link or an authorized search result to identify documents and tables.
Review names, times, recipients, and attachments before creating meetings or sending communications.

避免

Do not request or expose internal identifiers when readable names or links are available.
Do not assume a missing or ambiguous person, document, room, or time selection.
Do not rely on this skill for operations that the WeCom CLI or account permissions do not support.