Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/wecomteam/wecom-cli/wecomcli-messagenpx skills add WecomTeam/wecom-cli --skill wecomcli-messagegit clone --depth 1 https://github.com/WecomTeam/wecom-cliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00083 | $0.02236 |
| Opus 5 | $0.00042 | $0.01118 |
| Sonnet 5 | $0.00017 | $0.00447 |
| Haiku 4.5 | $0.00008 | $0.00224 |
Grade A, and why
wecomcli-message scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- 接口失败时如实转达错误，不使用 curl / Python 等方式绕过 `wecom-cli`。 Copies of this mod
1 near-identical copy found in the catalogue:
- wecomcli-message — 100% identical, 14 lines differ
How it starts
The opening of the file, as written. The whole thing — 201 lines — stays where its author put it; the contents beside it link to each section on GitHub.
企业微信发送消息
执行任何
wecom-cli命令前，必须先读取并完成wecomcli-shared技能的公共前置检查。
- 可以向授权人发送消息。
- 可以向授权人以外的、机器人最近有消息往来的聊天会话（单聊和群聊）发送消息。
适用范围
适用
- 适用于给授权人发消息，使用
wecom-cli identity whoami获取授权人ID，可作为chat_id使用，无需调用sessions list。 - 适用于查询当前有权限发送消息的聊天会话范围并给这些范围中的成员或群聊发送 Markdown 消息、图片、文件、AMR 语音或视频
不适用
- 发送对象不是授权人且不在本次
sessions list返回结果中 → 告知用户当前只能向最近活跃的会话或授权人发送
技能依赖
调用依赖技能前，必须先完整读取对应 SKILL.md。
| 依赖技能 | 触发场景 | 数据流向 |
|---|---|---|
wecomcli-media |
发送图片、文件、语音或视频时只有本地文件路径，没有可直接复用的 media_id |
包含媒体上传接口，如没有已有的 media_id，必须先阅读该技能获取 media_id，上传时传入的 type 应和发送时的msg_type 对齐 |
获取能发送消息的会话列表
命令
wecom-cli message aibot sessions list
返回
| 字段 | 类型 | 说明 |
|---|---|---|
sessions |
array | 会话列表，按最后一条消息时间从新到旧排序，具体数量以实际回包为准 |
sessions[].chat_id |
string | 会话 ID |
sessions[].chat_name |
string | 群名称或单聊名称 |
sessions[].chat_type |
string | single 单聊或 group 群聊 |
sessions[].last_msg_time |
string | 最后一条消息时间，格式 YYYY-MM-DD HH:MM:SS |
sessions_count |
integer | sessions 数组元素数量 |
chat_id 来源
向授权人以外的用户发送消息，调用 wecom-cli message aibot send 前，需要先调用一次 sessions list，然后从本次返回的 sessions[] 中选定目标项，把该项的 chat_id 原样复制到 send.chat_id。
以下值都不能直接作为 send.chat_id：
- 用户输入的 ID
- 之前轮次或历史上下文保存的
chat_id wecomcli-contact返回的userid- 根据姓名、群名或其他字段自行构造的值
这些值最多只能作为匹配线索；最终发送参数必须重新取自本次 sessions list 的匹配项。
目标会话匹配
- 聊天名称：在本次
sessions[]中按非空chat_name精确匹配；不能精确匹配需要向用户反问确认发送目标，唯一命中时从匹配项复制chat_id。 - 最近第一个/最近某个会话：按
sessions[]原始顺序选择用户明确指定的项。 - 用户提供 ID：只能与本次
sessions[].chat_id做完全相等校验；命中后仍从匹配项复制chat_id，不能直接复用用户输入值。
匹配结果处理：
- 唯一匹配时继续发送。
- 多个聊天会话候选时，按返回顺序展示聊天名和最后消息时间，让用户选择。
- 用户完成选择后，必须重新调用
sessions list，再用选定对象匹配当次返回值。 - 无匹配时停止发送，如实告知目标不在最近 10 个会话中；不要接受外部
chat_id绕过限制。 sessions_count=0时停止发送，告知当前没有可发送的最近会话。- 展示会话列表时保持接口原始顺序；展示名称和时间，不展示内部
chat_id。
发送消息
前置条件
调用本接口前必须完成以下步骤：
- 根据发送对象选择调用
wecom-cli message aibot sessions list获取chat_id或wecom-cli identity whoami获取授权人ID。 - 在本次列表中唯一匹配目标。
- 如果发送授权人以外的对象，从列表中匹配项原样复制
sessions[].chat_id。 - 目标是媒体消息时，再准备对应的
media_id。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 201 lines · 83 tokens per session scan A 1f60aaf8a20e
wecomcli-message is a skill published in the GitHub repository WecomTeam/wecom-cli (2,997 stars, last pushed 8d ago), licensed MIT. It adds 83 tokens to every session and 2,236 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.
chat-perf
Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…