notify-wecom

An agent skill by daymade, from daymade/claude-code-skills. Tags: automation, messaging, wechat.

What it does

Send a single one-off message to a WeCom (Enterprise WeChat) group bot. Use this skill whenever the user says "/notify-wecom", "send a quick WeCom message", "企微通知一下", "临时发一条企业微信", or any one-shot notification that does not need a reusable template or setup workflow.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add daymade/claude-code-skills --skill notify-wecom

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/daymade/claude-code-skills
cp -r claude-code-skills/notify-wecom ~/.claude/skills/notify-wecom

Safety box score

Grade C, moderate risk: 32 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a thin wrapper for sending a one-off text message to a WeCom group bot, driven by a home-directory config file. The main risks are outbound network transmission of user-supplied message content, exposure of the webhook URL secret, and automatic sending when `recipient_scope` is `self`.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	No bundled script is shipped, but the skill does point the agent toward a sender or an "equivalent inline curl call" to perform the action.
Network access	2 (moderate)	It intentionally sends message content to a remote WeCom webhook: "Sends via the WeCom webhook" and "inherits the host/project HTTP(S) proxy".
Filesystem reach	1 (low)	It reads a config file outside the project in the user's home directory: `~/.config/setup-notifications-via-wecom/config.json`.
Secrets & credentials	2 (moderate)	The shared config includes `webhook_url`, which is a credential-bearing secret used to authorize posting to the bot.
Privilege & persistence	0 (none)	There is no sudo, global install, service registration, or OS/shell configuration change in this skill.
Instruction hijack surface	0 (none)	The file does not ask the agent to ignore instructions, follow remote content, or hide actions; it instead requires confirmation for `others`.
Irreversible actions	2 (moderate)	It can send an external notification on the user's behalf, and for `recipient_scope` = `self` it "sends without an authorization prompt".
Transparency	0 (none)	The skill is plain Markdown with no binaries, encoded blobs, or unreadable generated code.

Before installing

Check `~/.config/setup-notifications-via-wecom/config.json` and treat `webhook_url` as a secret.
Verify `recipient_scope` and `recipient_label`; test with `self` before allowing `others`.
Confirm the host proxy settings are correct, since the skill inherits HTTP(S)_PROXY and `no_proxy`.
Use a test webhook or throwaway bot first to confirm the message content and routing.

Rated 2026-10-16 by an automated review of 1 file from the skill's repository.

Source

Repository: daymade/claude-code-skills (all skills from this repository)
Path: notify-wecom/SKILL.md
Branch: main
Updated: 2026-09-20

setup-notifications-via-wecom — Set up and send technical status notifications through WeCom (Enterprise WeChat) webhooks.
sms — When the user wants to plan, build, or optimize SMS or MMS marketing — including welcome flows, abandoned cart texts, post-purchase, win-back.
X Chat — Read, summarize, or send encrypted X Chat (XChat) DMs via the X plugin MCP plus local chatxdk / xchat_lite.py. Use when the user mentions X Chat, xchat.
agentic-actions-auditor — Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex.
agents-build — Use to extend an existing agent project with memory, app integration, VPC, multi-agent, migration, model, browser, code interpreter, payments.
agents-connect — Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies.