The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses standard system commands for service management (systemctl, launchctl) and environment setup (source, cat, tail). These are used exclusively for legitimate operational tasks like restarting the agent service or viewing log files.
[DATA_EXPOSURE]: Authentication tokens and QR codes are stored in the local data/wechat/ directory. The instructions explicitly warn users not to commit these files, following security best practices for local credential management.
[REMOTE_CODE_EXECUTION]: The skill downloads the wechat-ilink-client package via pnpm. This is the official client for the Tencent iLink API and is used for the primary function of the skill. No unverified or suspicious remote code execution patterns were found.
[COMMAND_EXECUTION]: A helper script scripts/wire-dm.ts executes the local ncl (NanoClaw) CLI tool to manage messaging group wirings. This interaction occurs via a local Unix socket to the running host service and is a standard part of the application's configuration workflow.

add-wechat