wecom-cli-enterprise-wechat

SUSPICIOUS due to transitive skill installation and agent-enabled real-world actions, but not malicious. Core capabilities, credentials, and data flows are broadly aligned with a WeCom CLI skill, and the main CLI install path appears to be the official npm package; the biggest concern is the separate `skills` installer trust chain rather than hidden exfiltration or deceptive data routing.