Cc

PassAudited by ClawScan on May 10, 2026.

Overview

This skill appears to do what it claims—relay an OpenClaw chat to a local Claude Code tmux session—but it gives that session persistent, high-impact access to your local projects.

Install this only if you want OpenClaw channels such as Telegram or CLI to control your local Claude Code sessions. Use private channels, choose project roots carefully, avoid relaying secrets, and stop sessions with `/cc off` when finished.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

While relay mode is active, your messages are sent to Claude Code rather than answered by the current assistant.

Why it was flagged

The skill deliberately redirects the assistant from normal answering into a relay role. This is purpose-aligned, but users should understand that normal assistant behavior is suspended until relay mode ends.

Skill content
After `/cc on <project>`, you enter relay mode: ... **ALL user messages are forwarded to Claude Code** — NEVER answer yourself
Recommendation

Use relay mode only when you intend to control Claude Code, and send `/cc off` when finished.

What this means

Messages sent through the relay can cause Claude Code to act within your local project using your local permissions.

Why it was flagged

The script starts a detached tmux session running `claude -c` inside the selected project. That is the core feature, but it exposes a powerful local coding tool through the relay.

Skill content
${TMUX_BIN} new-session -d -s "${sess}" "cd $(printf '%q' "${project}") && $(printf '%q' "${CLAUDE_BIN}") -c"
Recommendation

Use this only with trusted private channels and projects where you are comfortable letting Claude Code operate.

What this means

The relay may use whatever Claude Code account, session, approvals, and local permissions are already configured on the machine.

Why it was flagged

The skill relies on the user's existing Claude Code CLI/session context. This is expected for a Claude Code relay, but it means actions occur under the user's local Claude Code identity and permissions.

Skill content
Continues your existing `claude -c` sessions
Recommendation

Confirm Claude Code is logged into the intended account and has only the permissions you want before starting a relay session.

What this means

Claude Code output, which may include project details or secrets, can remain in local logs while the session is active.

Why it was flagged

The script stores session state and Claude Code pane output in local log files so it can return incremental output and support `/cc tail`.

Skill content
STATE_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/cc" ... LOG_DIR="${STATE_DIR}/logs" ... ${TMUX_BIN} pipe-pane -t "${sess}" "cat >> $(printf '%q' "${log}")"
Recommendation

Avoid sending secrets through the relay, use `/cc off` to stop sessions and remove the session log, and inspect the local state directory if needed.

What this means

A Claude Code session can keep running in the background after the initial command until you explicitly stop it.

Why it was flagged

The skill creates a detached tmux session that continues running until the stop command kills it. This persistence is disclosed and controlled by `/cc off`.

Skill content
${TMUX_BIN} new-session -d -s "${sess}" ... do_stop() ... ${TMUX_BIN} kill-session -t "${sess}"
Recommendation

Check `/cc status` and stop unused sessions with `/cc off`.