Try this API for 'internal' HCI commands: wiced_bt_dev_vendor_specific_command(uint16_t opcode, uint8_t param_len, uint8_t* p_param_buf, wiced_bt_dev_vendor_specific_command_complete_cback_t* p_cback);
For the detail usage, please refer to the API.html file.
You can refer to the watch example included in WICED. In particular, you should take a look at the hci_control_test_handle_command() and wiced_bt_send_test_command() function in hci_control_test.c.
Also refer to the WMBT tool to understand the different HCI commands used for RF testing.