yichen-wecom-operations

No strong evidence of self-contained malware in this specific module (no eval/exec, no obfuscation, no explicit credential/data stealing code). The primary security concern is operational supply-chain risk: it executes external binaries determined by environment variables (WECOM_CLI, WECOM_UPLOAD_HELPER), and when enabled it can upload locally referenced files embedded in untrusted Markdown to a remote service via the helper, then publish resulting URLs. If runtime environment variables or Markdown inputs are attacker-influenced, the risk is moderate to high, potentially including arbitrary code execution (via tampered executables) and data exfiltration (via local file uploads).