wechat-binding
WeChat binding: QR scan, bind, unbind, reconnect, status check. Use when setting up or repairing WeChat delivery (e.g. connect WeChat, scan QR, why isn't WeChat pushing, disconnect WeChat).
Security Assessment
Detected risks:
About wechat-binding
WeChat account binding for agent messaging: connect, reconnect, disconnect, and check the status of a user's WeChat so the agent can push messages via send_to_wechat. The wechat tool stays built in, and this document is the reference for driving it. The typical flow is to generate a QR code, have the user scan and confirm in WeChat, poll for completion, then connect with the returned bot_token.
Six actions are documented: status reports the current connection state, qrcode generates a QR image saved to the workspace and returns an id plus a file_path, qrcode_status polls whether the user scanned and confirmed and returns a bot_token, connect completes a first-ever binding, disconnect unlinks the session, and reconnect re-establishes a previously bound account from a fresh QR scan. The distinction between connect and reconnect is spelled out, with a recommendation to call status first when unsure which applies.
QR display is channel-aware: on web include the file_path for inline rendering, on Telegram send the image as a photo, and on the WeChat channel direct the user to the web app since they cannot yet receive it there. Several critical rules are stressed, including do not auto-poll qrcode_status but wait for the user to confirm they scanned, treat each qrcode call as a fresh image tied to its id, never paste the bot_token in chat because it is a credential, and confirm before the destructive disconnect. It is useful for setting up or repairing WeChat delivery.
FAQ
What actions does the wechat tool provide?
status, qrcode, qrcode_status, connect, disconnect, and reconnect, covering the full bind, verify, and unbind lifecycle.
What is the difference between connect and reconnect?
connect is first-time binding for a WeChat that was never bound before, while reconnect re-establishes a previously bound account after the connection dropped, using a token from a fresh QR scan.
Should qrcode_status be polled automatically?
No. The guidance is to wait for the user to confirm they scanned and confirmed in WeChat before polling, so as not to spam the upstream API.
How is the QR code shown to the user?
It is channel-aware: web includes the file_path for inline rendering, Telegram sends the image as a photo, and on the WeChat channel the user is told to open the web app instead.
How should the bot_token be handled?
As a credential. It must never be pasted into chat; instead pass it straight from qrcode_status into connect or reconnect without echoing it back.
Install wechat-binding
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
starchild-ai-agent/official-skills