PansClaw Code

Use the PansClaw Code CLI (Rust reimplementation of Claude Code) for AI-assisted coding. Triggers when: user wants to run coding tasks via pansclaw code, del...

This skill appears to be a local CLI wrapper for an AI coding assistant, but there are several red flags you should verify before installing or running it: - Provenance: The skill has no homepage or clear source. Prefer only installing tools from known repositories or vendor sites. Ask the publisher for the upstream repo or release URL. - Metadata mismatch: The registry lists no required env vars but the SKILL.md and references require MINIMAX_API_KEY, ANTHROPIC_API_KEY and (in places) OPENAI_API_KEY. Confirm which credentials are actually needed and why. - Absolute paths & user-specific files: The instructions and scripts reference /Users/dashi/... and ~/.openclaw-pansclaw/... which suggests the package was built for a specific machine. Inspect and adjust paths before running to avoid surprising file operations. - Dangerous permission flags: The skill and asset files enable 'danger-full-access' and encourage --dangerously-skip-permissions. Do not run with those flags unless you fully trust the binary and understand it can read/modify your workspace and manage agents. Prefer read-only or workspace-write permission modes and keep interactive permission prompts. - Inconsistent package names: The build targets differ across files (claw-cli vs rusty-claude-cli). Before building, open the Rust project to confirm the correct crate/package and review source code for unexpected network endpoints or commands. - Recommended steps if you want to try it safely: 1) Request the upstream repository or a signed release. Verify code before building. 2) Build in an isolated environment (container or disposable VM), do not run with --dangerously-skip-permissions there. 3) Inspect the built binary (strings, ldd, network activity) and run health checks (/doctor) in a sandbox. 4) Only provide cloud API keys that are scoped/minimized and revoke them if suspicious activity is observed. If you cannot obtain the upstream source or a trustworthy release, treat this skill as untrusted and avoid installing it on your primary machine.

Type: OpenClaw Skill Name: pansclaw-code Version: 0.1.0 The skill bundle provides a local AI coding assistant ('Claw') but exhibits high-risk patterns. Most notably, SKILL.md and the usage examples explicitly instruct the agent to use the '--dangerously-skip-permissions' flag, which bypasses user confirmation for potentially destructive file and system operations. Furthermore, the build and installation scripts (build.sh, install.sh) contain hardcoded absolute paths to a specific user's home directory (/Users/dashi/), which is non-standard for portable skill bundles. While these behaviors align with the tool's stated purpose of automated coding, the lack of safety defaults and environment-specific hardcoding warrants a suspicious classification.