Pane

v1.0.3

Access personal finance data (bank accounts, transactions, balances, spending, investments, crypto) via Pane's hosted MCP server using mcporter. Requires a P...

0· 365·2 current·2 all-time
byWilliam@darnfish
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description say it talks to Pane's hosted MCP server via mcporter; the SKILL.md only requires the mcporter binary and a PANE_API_KEY and shows mcporter commands calling pane.* endpoints — these requirements are proportionate and expected.
Instruction Scope
Instructions are narrowly scoped to configuring mcporter with the Pane MCP server and calling read/write endpoints (accounts, transactions, balances, annotations). The SKILL.md tells the user to export PANE_API_KEY and to run `mcporter config add` (which will store the Authorization header in mcporter's local config). This is expected but important to note because the token will be persisted locally and the skill exposes write_annotation capabilities that persist notes to the user's Pane account.
Install Mechanism
This is an instruction-only skill with no install spec and no direct downloads. It references installing/using a separate mcporter skill; there is no embedded install that would pull arbitrary code.
Credentials
Only one required environment variable (PANE_API_KEY) is declared and used, which is appropriate for an API-based finance integration. No unrelated credentials or system paths are requested.
Persistence & Privilege
The skill is not always-enabled and does not request unusual system privileges. However, it includes instructions and tools to write persistent annotations to the user's Pane account. Combined with normal autonomous invocation, an agent using this skill could create persistent notes in the user's Pane data — this is consistent with the skill's purpose but worth awareness.
Assessment
This skill appears coherent with its stated purpose, but consider the following before installing: - Only supply a PANE_API_KEY you trust and obtain it from https://pane.money. Treat it like any API secret: store it in a secrets manager or session environment rather than pasting in chat. - mcporter will store the Authorization header in its local config when you run `mcporter config add`; be aware the token will be persisted on disk in mcporter's config location. If you prefer not to persist it, use per-session env or revoke/rotate the key after use. - The skill supports write_annotation: an agent using this skill can add persistent notes to your Pane account. If you enable autonomous agent invocation, decide whether you want the agent able to create such persistent annotations without explicit confirmation. - Verify the mcporter skill/source you install (metadata references steipete/mcporter) is from a trusted publisher before installing. - If the key is ever exposed or used unexpectedly, rotate/revoke it immediately via your Pane dashboard. If you are comfortable with those tradeoffs (local config storage of the token, the agent's ability to persist annotations), the skill is internally consistent with its stated function.

Like a lobster shell, security has layers — review code before you run it.

latestvk976v5hxk3rwcwy33j0jt3zv0d823xa7

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

💳 Clawdis

Comments