Similar names and incomplete contact details can make employee lookup difficult. This skill guides WeCom directory searches and presents identifiers, departments, and matching details.
Review the Skillstore skill "wecomcli-contact" from https://skillstore.io/skills/wecomteam-wecomcli-contact.md and its manifest at https://skillstore.io/api/skills/wecomteam-wecomcli-contact/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.
All 20 static findings are false positives: Markdown backticks were misidentified as execution, and readable Chinese documentation triggered the entropy heuristic. No evidence found of prompt injection, credential theft, or unauthorized data transfer in SKILL.md. The external CLI and required shared skill were not included, so their behavior remains outside this review.
wecomteam. (2026). wecomcli-contact security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wecomteam-wecomcli-contact/audits/1
BibTeX 引用
@techreport{wecomteam-wecomteam-wecomcli-contact-2026,
author = {wecomteam},
title = {wecomcli-contact security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/wecomteam-wecomcli-contact/audits/1},
note = {Author version unspecified}
}
CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wecomcli-contact security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "wecomteam"
date-released: "2026-10-22"
url: "https://skillstore.io/skills/wecomteam-wecomcli-contact/audits/1"
identifiers:
- type: other
value: "skillstore:wecomteam-wecomcli-contact:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據證據置信度: 中
55
架構
85
可維護性
87
內容
65
社群
91
規範符合度
你可以打造什麼
Identify a colleague
Search by English name or pinyin and compare department paths before choosing the intended person.
Retrieve a user identifier
Find a contact and report the returned userid after resolving ambiguous matches.
Review matching names
Request all contacts matching a name and retain any warning that the returned list is incomplete.
試試這些提示
Find one contact
Find contacts matching [name] in the WeCom directory.
Resolve similar names
Search for [pinyin or English name]. Show user IDs and department paths so I can select the correct person.
Search several keywords
Search the WeCom directory for [keyword one], [keyword two], and [keyword three]. Preserve result order and show matched keywords.
Request all matching contacts
List all contacts matching [name] using list mode. Include returned user IDs, department paths, and management roles, and report any result-limit hint.
最佳實務
Complete the wecomcli-shared prerequisite checks before running any wecom-cli command.
Resolve ambiguous identities using returned identifiers and department paths while preserving API result order.
Use list mode only for explicit complete-list requests, and always report nonempty result-limit hints.
避免
Guessing search keywords when neither the request nor context supplies them.
Treating the first match as the intended person without resolving ambiguity.
Claiming a list is complete despite a result-limit hint, or presenting a management role as a general job title.
常見問題
What must be available before searching?
The wecom-cli binary must be available. Complete the prerequisite checks defined by the separate wecomcli-shared skill before running commands.
Which contact fields can I search?
Keywords can match names, name pinyin, English names, and aliases.
Can I search several names at once?
Yes. Each request accepts up to 10 keywords, and contacts matching any keyword can be returned.
How are ambiguous matches presented?
Ordinary searches initially show at most five candidates per keyword in API order. More candidates appear only when explicitly requested.
Does list mode guarantee every matching contact?
No. List mode requests all matches, but API limits can still restrict results. Any nonempty hint must be disclosed.
Can this skill update contacts or send messages?
No. This skill documents contact search only; it does not document contact editing or messaging commands.