SuperAPI AI Directory
Partner中文AI newsFavorites
Skillswecomcli-preflight

wecomcli-preflight

Office & productivity

View repository

Updated 10-16 09:20

About this skill

WeCom Prerequisite Check

This skill ensures that the wecom-cli tool has been correctly granted execution permission.All skills that use wecom-cli must perform this check flow before their first call.

Trigger Conditions

When the followingany conditionis met, perform the prerequisite check:

  1. In the current sessionfor the first timea call to the wecom-cli tool is needed
  2. When calling wecom-cli , receiving tool not allowed、not permitted、permission denied or a similar permission error

If the wecom-cli(any operation) has already been successfully called in the current session, no repeated check is needed.

Check Flow

Important: All of the following steps are shell commands(executed in the terminal), not wecom-cli tool calls. These shell commands are only used to check and modify OpenClaw tool permissions. They must not be used to directly run the global wecom-cli。 wecom-cli Before it is added to the allowlist, it is invisible to the AI Agent, so it cannot be probed with a tool call; at this point, complete the permission fix or report the problem to the user, and do not downgrade to exec / bash / shell / npx to execute the CLI, nor manually execute auth init。

Step 1: Check tools.profile

Execute the following command in the terminal to read the current tools.profile configuration:

openclaw config get tools.profile

Branch based on the returned result:

  • Returns full → ✅ Check passed。full mode has no tool restrictions, and all tools (including wecom-cli) are directly available, so there is no need to check alsoAllow, continue executing the user's original request; passing only means the dedicated tool is available, and even if exec exists, the dedicated wecom-cli tool must be called, and the global CLI must not be run directly
  • Returns another value(such as coding、messaging、minimal、undefined or empty) → go to Step 1b (check alsoAllow)
  • Command execution fails(such as command not found: openclaw, permission error, etc.) → go to Step 3 (environment anomaly)

Step 1b: Check tools.alsoAllow

Execute the following command in the terminal to read the current tools.alsoAllow configuration:

openclaw config get tools.alsoAllow

Branch based on the returned result:

  • The returned content includes wecom-openclaw-plugin(such as ["wecom-openclaw-plugin"] or ["wecom-openclaw-plugin", "other_tool"]) → ✅ The plugin is allowed, the check passes, continue executing the user's original request
  • The returned content does not include wecom-openclaw-plugin(such as an empty array []、undefined, or the list contains only old entries wecom_mcp) → go to Step 2 (automatic fix)
  • Command execution fails → go to Step 3 (environment anomaly)

Step 2: Automatically fix tools.alsoAllow

Execute the following command in the terminal to add the WeCom plugin to the tool allowlist:

openclaw config set tools.alsoAllow '["wecom-openclaw-plugin"]'

Permission boundary: Allowing by plugin ID will allow all tools currently and future registered by that plugin; this is the recommended configuration for this plugin.

Note: If the list returned by step 1b already contains other tools (such as ["other_tool"]), they need to be merged before writing, for example:

openclaw config set tools.alsoAllow '["other_tool", "wecom-openclaw-plugin"]'

The old wecom_mcp entry is no longer valid and can be kept or deleted on your own; do not overwrite other configurations just to clean up old entries.

Branch based on the execution result:

2a. Command executed successfully

Reply to the user (Do not automatically execute a restart）：

✅ 已自动将企业微信插件（wecom-openclaw-plugin）加入工具执行权限白名单（tools.alsoAllow）。
⚠️ 配置变更需要重启 Gateway 后才能生效，请在终端执行以下命令：

openclaw gateway restart

重启完成后请重新发送您的请求。

Why not restart automatically：openclaw gateway restart will interrupt all currently active connections (including this session). If the AI executes it automatically, the user may not be able to see the complete prompt information. It is more controllable to let the user restart manually.

2b. Command execution failed

Reply to the user with the following manual repair instructions:

❌ 自动配置失败，请在终端手动执行以下命令：

openclaw config set tools.alsoAllow '["wecom-openclaw-plugin"]'
openclaw gateway restart

完成后请重新发送您的请求。

Step 3: Environment exception handling

If the openclaw command in step 1 or 1b itself fails to execute (such as command not found, insufficient permissions, etc.), it means the OpenClaw CLI is not correctly installed or is not in PATH. Directly tell the user:

⚠️ OpenClaw CLI 不可用：<错误信息>

可能原因：
- OpenClaw 未安装或未加入系统 PATH
- OpenClaw 版本过低，不支持 config 子命令
- 当前 shell 环境缺少必要配置

请检查 OpenClaw 安装状态后重试。
参考：https://docs.openclaw.dev/installation

Notes

  1. Use shell commands throughout: All detection and repair operations of this skill are executed in the terminal via the openclaw CLI,do not call the wecom-cli tool. This avoids the deadlock problem of "tool not whitelisted → tool invisible → unable to detect"
  2. Judge profile first：tools.profile is full , all tools are unrestricted, no need to check alsoAllow, can be skipped quickly
  3. Idempotency: If tools.alsoAllow already contains wecom-openclaw-plugin, there is no need to write it again
  4. Allow by plugin ID：wecom-openclaw-plugin will expand to all tools currently and future registered by that plugin
  5. Preserve existing configuration: When modifying tools.alsoAllow , existing entries must be preserved, only append wecom-openclaw-plugin; the old wecom_mcp can be kept or deleted on your own
  6. Do not restart automatically: After automatic configuration succeeds, only prompt the user to restart and provide the command, to be executed manually by the user, avoiding information loss caused by session interruption
  7. Session cache: Once the check passes in the same session (profile is full or alsoAllow contains the plugin ID), subsequent calls do not need to repeat the check
  8. Prohibit bypass and downgrade：wecom-cli dedicated tool internally starting the binary is a normal implementation; what is prohibited is the Agent using exec / bash / shell / npx to run the global CLI. When the dedicated tool fails, is invisible, or prompts for authorization, the permission or configuration problem must be reported, and auth init

must not be executed manually

Scenario Handling method
Before the first call to wecom-cli Execute openclaw config get tools.profile check
tools.profile is full ✅ Skip, directly execute the original request
profile is not full + alsoAllow already contains wecom-openclaw-plugin ✅ Skip, continue execution
profile is not full + alsoAllow only has the old wecom_mcp or does not contain the plugin ID → automatic write succeeds Append the plugin ID, prompt that it has been configured + attach the openclaw gateway restart command to let the user restart
profile is not full + alsoAllow does not contain the plugin ID → automatic write fails Provide manual repair instructions
openclaw CLI is unavailable Instruct the user to check the OpenClaw installation
wecom-cli has already been successfully called in the session Skip the check