wecomcli-shared
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the
@wecom/clipackage from NPM if the tool is missing or outdated. This package is the official command-line interface provided by the vendor and is considered a safe resource for its intended purpose. - [COMMAND_EXECUTION]: The skill executes local shell commands such as
wecom-cli --versionandwecom-cli auth show --statusto verify the environment and authentication state. These commands are necessary for the tool's core functionality. - [DATA_EXFILTRATION]: The skill contains a dedicated section for 'General Output Constraints' which strictly prohibits the agent from displaying internal identifiers (such as
userid,chat_id, ormail_id) in final responses to the user. This instruction serves as a security best practice to prevent system metadata leakage.
Audit Metadata