setup-notifications-via-wecom

An agent skill by daymade, from daymade/claude-code-skills. Tags: alerts, automation, messaging, wechat.

What it does

Set up and send technical status notifications through WeCom (Enterprise WeChat) webhooks. Use this skill whenever the user needs to send notifications, alerts, backup completion reports, or status updates via WeCom; when they mention 企业微信, 企微机器人, webhook, or alerting; or when a message needs to be clear, unambiguous, and technically precise rather than vague or condescending.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add daymade/claude-code-skills --skill setup-notifications-via-wecom

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/daymade/claude-code-skills
cp -r claude-code-skills/setup-notifications-via-wecom ~/.claude/skills/setup-notifications-via-wecom

Safety box score

Grade C, moderate risk: 39 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill sends plain-text notifications to a WeCom webhook and stores the webhook plus recipient metadata in a home-directory config file. The main risks are external message delivery on the user’s behalf, plaintext secret storage, and a direct-curl path that bypasses some of the script’s recipient checks.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It runs bundled Python code via `uv run --no-project python scripts/send_wecom.py` and `scripts/set_recipient.py`; that is real script execution, though not arbitrary code evaluation.
Network access	2 (moderate)	It makes outbound HTTP POSTs to the WeCom webhook (`urllib.request.urlopen(...)` / `curl -X POST 'https://qyapi.weixin.qq.com/cgi-bin/webhook/send?...'`) and can retry sends.
Filesystem reach	2 (moderate)	It reads and writes `~/.config/setup-notifications-via-wecom/config.json` and uses a temp file in that dot-directory, so it touches the user’s home config area outside the repo.
Secrets & credentials	2 (moderate)	The webhook URL key is stored in plaintext in `config.json` (`"webhook_url": "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=..."`), which is a reusable secret-like token.
Privilege & persistence	0 (none)	There is no sudo, service installation, shell startup editing, or global system change in the reviewed files.
Instruction hijack surface	0 (none)	The files do not contain prompt-injection behavior such as fetching remote instructions or telling the agent to ignore its rules; they mainly define checks and send logic.
Irreversible actions	2 (moderate)	Its purpose is to send notifications on the person’s behalf, including to external WeCom groups after configuration; that is a real outbound action, though it is limited to messaging.
Transparency	0 (none)	The bundle is fully readable source/markdown; there are no binaries, packed payloads, or code downloaded at runtime.

Before installing

Read `scripts/send_wecom.py` and `scripts/set_recipient.py`; confirm you want a persistent `~/.config/setup-notifications-via-wecom/config.json` file holding the webhook URL.
If you may send to `others`, verify the confirmation workflow you expect; the raw `curl` option does not enforce the script’s recipient-binding checks.
Test first with a throwaway WeCom webhook in a scratch account or group before using a real production channel.

Rated 2026-10-20 by an automated review of 8 files from the skill's repository.

Source

Repository: daymade/claude-code-skills (all skills from this repository)
Path: setup-notifications-via-wecom/SKILL.md
Branch: main
Updated: 2026-09-20

notify-wecom — Send a single one-off message to a WeCom (Enterprise WeChat) group bot.
sms — When the user wants to plan, build, or optimize SMS or MMS marketing — including welcome flows, abandoned cart texts, post-purchase, win-back.
X Chat — Read, summarize, or send encrypted X Chat (XChat) DMs via the X plugin MCP plus local chatxdk / xchat_lite.py. Use when the user mentions X Chat, xchat.
setting-up-cloudwatch-alarm-notifications — Sets up notification channels for CloudWatch alarms using SNS topics and subscriptions.
agentic-actions-auditor — Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex.
agents-build — Use to extend an existing agent project with memory, app integration, VPC, multi-agent, migration, model, browser, code interpreter, payments.