Panews Creator

Create and manage articles on the PANews platform. All operations require a valid user session. Triggers: write and publish new articles, view / edit / delet...

This package appears to implement a CLI for PANews and mostly does what its name says, but exercise caution before installing or running it: - Do not paste your PA-User-Session cookie into chat. Prefer setting it in a secure environment variable or secret manager if you decide to run the CLI locally. - The package includes a Node script but the registry metadata does not declare Node as a required binary—make sure you run it intentionally in a controlled environment (e.g., a disposable VM or container) and verify the Node runtime version. - Inspect scripts/cli.mjs (the full file) for any unexpected network endpoints or obfuscated code. The file header claims a GitHub source; verify that the repository and commit match the shipped code and confirm checksums if possible. - The SKILL.md contains detected unicode-control characters (possible prompt-injection). Open SKILL.md in a text editor that can show hidden characters and remove/confirm them before using the skill. - If you only need offline polishing/editing help, use the 'polish' workflow which explicitly does not call the CLI or require a session. What would increase confidence: a verifiable upstream repository URL and commit, declared runtime requirements (Node), explicit declared env vars in metadata, and removal/explanation of the unicode-control characters in SKILL.md.

Type: OpenClaw Skill Name: panews-creator Version: 0.2.0 The skill bundle is a legitimate tool for managing articles and columns on the PANews platform. The CLI script (scripts/cli.mjs), although minified, implements standard API interaction logic with the official domain (universal-api.panewslab.com) and includes a local Markdown-to-HTML parser for processing article content. The documentation (SKILL.md and reference files) provides clear, task-aligned workflows and includes security best practices, such as advising users to provide session tokens via environment variables rather than command-line arguments to prevent exposure in process lists.