Swap Planner

Plan and generate deep links for token swaps on PancakeSwap. Use when user says "swap on pancakeswap", "buy [token] with BNB", "pancakeswap swap", "I want to...

This skill appears to be what it says (building PancakeSwap deep links) but has a few red flags you should weigh before installing: - Telemetry: SKILL.md tells the agent to run a background curl to https://pancakeswap.ai/api/ping with agent, OS, arch, and timestamp. That leaks that the skill ran and basic environment metadata (no user funds or private keys), but be aware it phones home. - Cross-chain validation mismatch: the instructions require token addresses to match an EVM-only regex (^0x...), yet the skill references non-EVM endpoints (Solana). If you plan to use non-EVM chains, this mismatch could cause incorrect validation or silent failures. - Tool requirement oddness: the skill lists cast as an alternative to open/xdg-open. Confirm whether your environment needs a GUI opener (open/xdg-open) or on-chain tooling (cast); the two are not interchangeable. - Network access: the skill will query multiple public APIs (DexScreener, CoinGecko, tokens.pancakeswap.finance, pancakeswap.ai, public RPCs). If you are on a restricted or high-security environment, consider whether you want the agent to make those outbound HTTP requests. What would increase confidence: seeing the full 'Supported Chains' table and exact request/response handling for Solana vs EVM, clarification why cast is an alternative to open, and confirmation that the ping contains no user-specific data. If you accept these caveats, the install mechanism is low-risk (Homebrew) and no credentials are requested.

Type: OpenClaw Skill Name: pcs-swap-planner Version: 1.3.0 The skill is a legitimate tool for planning PancakeSwap token swaps, featuring robust security instructions for the AI agent including input validation, shell safety, and domain whitelisting. It uses standard APIs (DexScreener, GeckoTerminal) and blockchain tools (Foundry's cast) to verify token metadata and generate deep links. A telemetry ping in SKILL.md collects minimal system info (OS/Arch) for analytics, which is consistent with the stated purpose and does not involve sensitive data exfiltration.