CodeBuddy Code for OpenClaw

CodeBuddy Code CLI installation, configuration and usage guide. CodeBuddy Code is Tencent's AI-powered CLI programming assistant supporting natural language driven development. - MANDATORY TRIGGERS: CodeBuddy, codebuddy, AI CLI, Tencent AI coding, @tencent-ai/codebuddy-code, terminal AI assistant - Use when: installing CodeBuddy CLI, configuring CodeBuddy, using CodeBuddy commands, troubleshooting CodeBuddy issues

Security Scan

The skill is an instruction-only guide for installing and using a CodeBuddy CLI and its requirements and instructions are generally consistent with that purpose, but lack of a verifiable source/homepage and the recommendation to install a global npm package warrant caution.

Purpose & Capability

Name/description match the instructions: the SKILL.md describes installing and using a CodeBuddy CLI and all steps (npm install, CLI commands, config paths) are consistent with that purpose. The triggers and usage contexts align with a CLI assistant.

Instruction Scope

Runtime instructions are limited to installing the npm package, running the CLI, using its flags and commands, and where to place custom command files. There are no instructions to read unrelated system files, exfiltrate data, or access unrelated environment variables. The guide warns about the risky -y flag.

Install Mechanism

The skill is instruction-only and tells users to run npm install -g @tencent-ai/codebuddy-code — this is a normal install flow for a CLI. However, the skill metadata lacks a homepage or source repository, so the authenticity of the npm package cannot be verified from the skill alone; that raises a trust/typosquatting concern when installing a global package.

Credentials

The skill does not request environment variables or credentials. It mentions login methods (Google/GitHub/WeChat) as user-facing auth flows, which is appropriate and expected for a CLI that interacts with remote models.

Persistence & Privilege

The skill is not always-enabled and does not request elevated or persistent platform privileges. It only instructs installing a global CLI (which is user-level persistence) and writing config/custom commands to ~/.codebuddy or a project folder — these are standard for a CLI tool.

Assessment

This skill is a coherent install/use guide for a CodeBuddy CLI, but the SKILL.md does not provide a homepage or source repository to verify the npm package. Before running npm install -g @tencent-ai/codebuddy-code: 1) look up the package on the npm registry and confirm the publisher/organization is legitimate (check the maintainer/owner and package versions); 2) find and review the project repo or homepage (if available) to inspect code or at least read README and issues; 3) prefer running via npx or in a container/sandbox first instead of a global install; 4) avoid using the -y/--dangerously-skip-permissions flag in real projects; 5) if you must install globally, inspect package contents or run virus/malware scans and consider limiting network/credential access for the first runs. If you can provide the package/npm link or repository, I can re-evaluate with higher confidence.

CodeBuddy CLI Skill

AI-powered terminal programming assistant from Tencent.

Installation

# Check prerequisites
node -v  # Requires Node.js 18+
npm -v

# Install globally
npm install -g @tencent-ai/codebuddy-code

# Verify
codebuddy --version

Quick Start

1. Navigate to project directory
2. Run codebuddy to start interactive session
3. Choose login method:
   • Google/GitHub: International version (Gemini, GPT models)
   • WeChat (微信): China version (DeepSeek models)

CLI Arguments

Argument	Description
codebuddy "<prompt>"	Execute single task
-y / --dangerously-skip-permissions	Skip permission confirmations (sandbox only)
-p / --print	Single execution mode (requires -y for file ops)
--permission-mode <mode>	acceptEdits, bypassPermissions, default, plan
--version	Show version

Examples

# Interactive mode
codebuddy

# Single task
codebuddy "帮我优化这个函数的性能"
codebuddy "生成这个 API 的单元测试"
codebuddy "检查这次提交的代码质量"

# Skip permissions (sandbox only)
codebuddy -p "Review code quality" -y

Slash Commands

Command	Description
/help	Display available commands
/status	Show account info and current model
/login	Switch accounts
/logout	Sign out
/clear	Reset conversation history
/exit	End session
/config	Open configuration
/doctor	Diagnose issues
/cost	Token usage statistics
/init	Generate CODEBUDDY.md project guide
/memory	Edit project memory files

Type ? during session for keyboard shortcuts.

Custom Commands

Create .md files in:

• Project: .codebuddy/commands/
• Global: ~/.codebuddy/commands/

Update

npm install -g @tencent-ai/codebuddy-code

Security Notes

--dangerously-skip-permissions risks: file deletion, scope creep, data loss. Never use in production.