docs: add WeChat channel via @tencent-weixin/openclaw-weixin

[yixinrock]

Summary

Adds WeChat (微信) as an officially-supported channel in the README, using the @tencent-weixin/openclaw-weixin plugin provided by Tencent.

Tencent recently opened a WeChat integration entry point for OpenClaw, installable via:

npx -y @tencent-weixin/openclaw-weixin-cli@latest install

Changes

• Added WeChat to the channel list in the intro paragraph, Highlights section, and architecture diagram
• Added WeChat to the Channels subsystem table with a docs link
• Added a WeChat setup section with install command, supported features, and config notes

Notes

• This is the official Tencent-provided plugin, distinct from community hacks (e.g., [Community Channel] WeChat (微信) Channel for OpenClaw #43116)
• Requires WeChat PC (desktop client) running on the same machine
• channels.wechat.allowFrom controls which senders can interact with the assistant

Closes #43116

[greptile-apps]

Greptile Summary

This PR adds WeChat as a supported channel across the README — in the intro paragraph, Highlights list, ASCII architecture diagram, channels table, and a new setup section. The documentation additions are generally well-structured and consistent with how other channels are presented.

However, there is a critical concern with the new WeChat setup section:

• Unverifiable package: @tencent-weixin/openclaw-weixin-cli cannot be found on the npm registry. No package exists under this name or the @tencent-weixin scope. The only Tencent-published OpenClaw plugin found is @wecom/wecom-openclaw-plugin, which targets WeCom (Enterprise WeChat) rather than consumer WeChat.
• npx -y flag: The install command uses npx -y, which silently bypasses npm's "install this package?" confirmation prompt. In the context of documented malicious npm packages actively impersonating OpenClaw tooling (deploying RATs and stealing macOS Keychain credentials), recommending silent auto-install for an unverified package is a meaningful supply-chain risk.

The PR should not be merged until the package name is confirmed as published on npmjs.com and the -y flag is removed.

Confidence Score: 1/5

• Not safe to merge — the PR documents an install command for an npm package that cannot be verified as existing, using a flag that silently bypasses user confirmation, in an ecosystem with active supply-chain attacks.
• The only changed file is README.md, but it introduces a npx -y install command pointing to @tencent-weixin/openclaw-weixin-cli, a package that does not appear to exist on the npm registry. Given that malicious npm packages impersonating OpenClaw tooling have been publicly reported (deploying RATs and stealing credentials), merging documentation that directs users to silently run an unverified package is a supply-chain risk that blocks merge.
• README.md — specifically the new WeChat setup section (lines 400–410) and the install command it documents.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: README.md
Line: 400-404

Comment:
**Unverified package recommended with silent install flag**

The install command `npx -y @tencent-weixin/openclaw-weixin-cli@latest install` has two compounding issues:

1. **`@tencent-weixin/openclaw-weixin-cli` does not appear to exist on the npm registry.** A search of npmjs.com finds no package under this name or the `@tencent-weixin` scope. The closest legitimate Tencent-published OpenClaw channel plugin found is `@wecom/wecom-openclaw-plugin` (for WeCom/Enterprise WeChat), which is a different product entirely.

2. **`-y` silently bypasses npm's install confirmation.** Given recently reported active exploitation of malicious npm packages posing as OpenClaw tooling (deploying RATs and stealing macOS credentials), recommending `npx -y` for an unverified package in this ecosystem is a meaningful supply-chain risk. Users should at minimum be prompted before the package runs.

Before merging, the PR author should confirm the exact published package name on npmjs.com and remove the `-y` flag (or document why it is safe).

```suggestion
  ```bash
  npx @tencent-weixin/openclaw-weixin-cli@latest install
  ```
```

How can I resolve this? If you propose a fix, please make it concise.

_{Last reviewed commit: "docs: add WeChat cha..."}

[greptile-apps]

Unverified package recommended with silent install flag

The install command npx -y @tencent-weixin/openclaw-weixin-cli@latest install has two compounding issues:

1. @tencent-weixin/openclaw-weixin-cli does not appear to exist on the npm registry. A search of npmjs.com finds no package under this name or the @tencent-weixin scope. The closest legitimate Tencent-published OpenClaw channel plugin found is @wecom/wecom-openclaw-plugin (for WeCom/Enterprise WeChat), which is a different product entirely.

2. -y silently bypasses npm's install confirmation. Given recently reported active exploitation of malicious npm packages posing as OpenClaw tooling (deploying RATs and stealing macOS credentials), recommending npx -y for an unverified package in this ecosystem is a meaningful supply-chain risk. Users should at minimum be prompted before the package runs.

Before merging, the PR author should confirm the exact published package name on npmjs.com and remove the -y flag (or document why it is safe).

Suggested change

	### [WeChat](https://docs.openclaw.ai/channels/wechat)
	- Install the official WeChat plugin via the Tencent-provided CLI:
	```bash
	npx -y @tencent-weixin/openclaw-weixin-cli@latest install
	```bash
	npx @tencent-weixin/openclaw-weixin-cli@latest install

<details><summary>Prompt To Fix With AI</summary>

`````markdown
This is a comment left during a code review.
Path: README.md
Line: 400-404

Comment:
**Unverified package recommended with silent install flag**

The install command `npx -y @tencent-weixin/openclaw-weixin-cli@latest install` has two compounding issues:

1. **`@tencent-weixin/openclaw-weixin-cli` does not appear to exist on the npm registry.** A search of npmjs.com finds no package under this name or the `@tencent-weixin` scope. The closest legitimate Tencent-published OpenClaw channel plugin found is `@wecom/wecom-openclaw-plugin` (for WeCom/Enterprise WeChat), which is a different product entirely.

2. **`-y` silently bypasses npm's install confirmation.** Given recently reported active exploitation of malicious npm packages posing as OpenClaw tooling (deploying RATs and stealing macOS credentials), recommending `npx -y` for an unverified package in this ecosystem is a meaningful supply-chain risk. Users should at minimum be prompted before the package runs.

Before merging, the PR author should confirm the exact published package name on npmjs.com and remove the `-y` flag (or document why it is safe).

```suggestion
  ```bash
  npx @tencent-weixin/openclaw-weixin-cli@latest install

How can I resolve this? If you propose a fix, please make it concise.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 29a5f2375d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Publish the WeChat docs route before linking to it

This change sends readers to https://docs.openclaw.ai/channels/wechat, but the repo does not publish that route: there is no docs/channels/wechat.md, and the canonical channel list in docs/channels/index.md:13-36 still stops at Zalo Personal. In practice the new README entry becomes a dead link and an undiscoverable setup path, so users who click through from the supported-channels list cannot find install or configuration docs for the feature being advertised.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b9619b655c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Publish the WeChat docs page before linking to it

Fresh evidence on the current tree: docs/channels/index.md:14-37 still omits WeChat, a repo-wide docs search finds no docs/channels/wechat.md, and the live https://docs.openclaw.ai/channels/wechat route currently 404s. That means this heading (and the new channel entry above) sends README readers to a dead page instead of a canonical setup guide, so the newly advertised channel is still undiscoverable outside this short snippet.

Useful? React with 👍 / 👎.

[yixinrock]

Thanks for the careful review, @greptile-apps.

On the package existence: @tencent-weixin/openclaw-weixin-cli does exist on npm — it was published by Tencent engineers (maintainers: @tencent.com emails). You can verify:

npm info @tencent-weixin/openclaw-weixin-cli

It returns v1.0.2 with Tencent maintainers. This is the official entry point Tencent opened for WeChat integration with OpenClaw.

On the -y flag: Fair point — removed in the latest commit. Users should see the install prompt rather than silently bypass it.

[greptile-apps]

Perfect, thanks for verifying the package and removing the -y flag. That addresses both concerns — users will now see the install prompt as intended. Looks good to merge from my side.

[yixinrock]

Good catch — removed the /channels/wechat doc link since the page doesn't exist yet. The WeChat entry now appears without a docs link; a dedicated docs page can be added in a follow-up once the channel is officially landed.