ClawHub

FlowyTeam

v1.0.2

Manage FlowyTeam projects, tasks, OKRs, KPIs, HR, CRM, finance, support tickets, attendance, and more via MCP — 31 tools covering the full FlowyTeam workspace.

⭐ 0· 60·0 current·0 all-time
byAgung Sidik Muhamad@agungksidik
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
CryptoCan make purchasesRequires OAuth token
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
Name/description (FlowyTeam MCP) match the instructions and declared requirement (FLOWYTEAM_API_TOKEN). The skill only documents an HTTP MCP endpoint at flowyteam.com and 31 CRUD tools that align with a workspace management API. Note: the package has no homepage/source URL in the registry metadata and the provided _meta.json version differs from the registry version — this is an administrative/integrity note (not evidence of malicious behavior) and you may want to verify the publisher.
✓
Instruction Scope
SKILL.md instructs only how to register an MCP HTTP server pointing to https://flowyteam.com/api/v2/mcp/rpc and to supply Authorization: Bearer <token>. It does not instruct reading unrelated files, scanning system state, or sending data to third-party endpoints beyond the declared FlowyTeam API.
✓
Install Mechanism
Instruction-only skill with no install spec and no code files to write or execute on disk — lowest-risk install mechanism.
ℹ
Credentials
Only one env var is required (FLOWYTEAM_API_TOKEN), which is appropriate for an API-bound MCP connector. However, this token likely grants broad API privileges (CRUD across HR, finance, CRM, etc.), so ensure you use a token with least privilege (or an admin-scoped token only if you intend to perform admin actions).
✓
Persistence & Privilege
always is false and the skill does not request any system-wide configuration or cross-skill modifications. The default ability for the agent to invoke the skill autonomously is allowed (normal for skills) and not, by itself, a concern here.
Assessment
This skill appears to be what it claims: an MCP HTTP connector to FlowyTeam that needs one API token. Before installing, verify the publisher (the registry metadata lacks a homepage and source—confirm it's the official FlowyTeam skill), and only provide an API token with the minimum permissions needed (avoid giving a long-lived admin token unless required). If possible, test with a scoped or test workspace token, monitor API activity, and be prepared to revoke the token if you detect unexpected behavior.

Like a lobster shell, security has layers — review code before you run it.

latestvk974weq4ysevnfmeqxxr4exr8n84pf14

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

EnvFLOWYTEAM_API_TOKEN

Comments