weclaw-wechat-ai-bridge

SUSPICIOUS. The skill’s capabilities largely match its stated WeChat bridge purpose, and install/data-flow references are mostly same-org and documented upstream, so this is not confirmed malware. However, the curl|sh installer, unauthenticated externally bindable local API, and explicit guidance to disable agent permission prompts make the skill high-trust and potentially risky for autonomous messaging workflows.