Three Minds

三个能干活的 AI 分身协作系统。用 Claude Code 启动三个不同人设的 coding agent，共享同一个工作目录，多轮协作直到达成共识。适用于代码审查、方案评审、重构任务等需要多视角协作的场景。

This skill does what it says (runs three Claude-based agents that can read/modify files), but you should be cautious before running it on sensitive systems: 1) It spawns the 'claude' CLI with the full host environment, which can expose any environment secrets to the child process — do not run it where API keys or cloud credentials are present. 2) It uses a flag to skip permission confirmations, letting agents act automatically; run first in a sandboxed environment (container or disposable VM) and on a git branch. 3) Inspect and, if needed, remove or modify the '--dangerously-skip-permissions' usage and avoid passing process.env wholesale to the child process. 4) Verify the 'claude' CLI you have installed is from a trusted source. 5) If you must use it on real projects, restrict the working directory to a copy of the repo and ensure no secrets are present in files or env. If you want, I can point out the exact lines to change to avoid env forwarding and the skip-permissions flag.

Type: OpenClaw Skill Name: three-minds Version: 0.1.0 This skill is classified as suspicious due to its inherent high-risk capabilities and the broad permissions granted to sub-agents. The `SKILL.md` and `README.md` explicitly state that agents will "read files, write code, and run tests," and "actually modify files." The `src/council.ts` implementation invokes the `claude` CLI with the `--dangerously-skip-permissions` flag, which grants the sub-agents (Claude instances) broad, unconfirmed access to the file system, network, and shell execution. Additionally, user-defined `persona` strings (from `configs/*.json` or custom `--config` files) are directly incorporated into the sub-agents' system prompts, creating a significant prompt injection surface that, combined with the broad permissions, could lead to unintended or malicious actions by the sub-agents.