不是聊天机器人，是你口袋里的AI员工。Claude Anywhere 让你通过 Telegram、企业微信、QQ 随时随地读写文件、执行命令、分析图片、管理代码。Not a chatbot — your AI engineer in your pocket. Claude Anywhere lets you re...

Plain-language summary and recommended precautions: - What it does: this repository implements a Telegram/WeCom/QQ bot that forwards user messages, images, and files to the local Claude CLI and returns the model's responses. It intentionally saves attachments to /tmp, instructs the model to read those files, and can schedule recurring jobs and run commands — exactly as the README claims. - Mismatches you should notice: the registry metadata only lists TELEGRAM_BOT_TOKEN as required, but the code also expects WeCom and QQ credentials if you run those bridges. The package includes a license component that computes a machine id and builds payment/activation URLs — the license flow may send an identifier to the vendor's server. - Privacy & security risks: - Running this gives the bot and the Claude CLI access to local files and (per the README) the ability to execute commands: treat it like giving remote users a shell on your machine. If a malicious user or model prompt causes the bot to run CLI commands or read sensitive files, those secrets can be exposed. - The license flow likely transmits a machine identifier (getMachineId) to external servers; this can fingerprint your host. - The code runs as a persistent service when you follow the systemd instructions, increasing the blast radius of a compromise. - Before you install/run it, consider: 1. Inspect license-client.mjs and core.mjs to confirm exactly what is sent to the license server (what machine identifiers, network endpoints, and timing). If you don't want host fingerprinting, do not enable Pro activation or block license server access. 2. Run the bot in a sandbox/container or on a non-sensitive host (not a production server) if you want to test it. 3. Use a dedicated Telegram bot account with minimal privileges and avoid reusing tokens from important accounts. Do not run as root; use a restricted user account. 4. If you need WeCom/QQ support, only provide those credentials when you intend to run those bridges and understand they are required. Metadata underspecifies these requirements — the platform will not automatically provide them. 5. Review package-lock.json and installed npm dependencies for supply-chain risk. 6. If you must run it on a server with sensitive data, consider network restrictions (eg. firewall to block calls to the license server or outgoing traffic you don't expect) and monitor outbound connections. - Additional steps to reduce risk: audit or remove the license-client code if you don't want automatic activation/fingerprint reporting; avoid using the 'auto-activate after payment' flow if you require privacy; consider replacing calls to external endpoints with stubs in a fork. Given the code's intended high privileges (file read/write, command execution, persistent service) and the metadata mismatch plus the prompt-injection signal and license/fingerprinting behavior, proceed with caution and prefer sandboxed testing.

Type: OpenClaw Skill Name: claude-anywhere Version: 1.6.2 The skill acts as a remote bridge for the Claude Code CLI, allowing users to execute shell commands, manage files, and run scheduled tasks via Telegram, QQ, and WeChat Work. A significant security risk is identified in 'core.mjs' and 'cron-manager.mjs', where the tool invokes the Claude binary with the '--dangerously-skip-permissions' flag, effectively granting the AI agent (and anyone with access to the bot) unprompted shell access to the host system. While these high-risk behaviors are aligned with the stated purpose of providing a remote 'AI engineer,' the lack of interactive permission gates for sensitive operations makes the bundle inherently dangerous. The skill also communicates with an external licensing endpoint at https://license.claudeanywhere.com.