MissingLinkz
v1.0.6Campaign link builder and pre-launch validator for AI agents. Build UTM-tracked links, validate destinations, and inspect landing pages for social sharing re...
⭐ 1· 141·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (UTM generation, preflight checks) match the declared binary (mlz), the single required env var (MLZ_API_KEY), and the config path (~/.missinglinkz/config.json). Requiring an API key and a local config file is expected for storing account info and campaign data.
Instruction Scope
SKILL.md only instructs running the mlz CLI for building links, inspecting pages, and account actions (register/login/status), plus an MCP stdio tool. It does not instruct reading unrelated files or environment variables beyond MLZ_API_KEY, nor does it direct data to unexpected external endpoints in the instructions. The MCP server claim (stdio-only) is explicitly documented in the SKILL.md.
Install Mechanism
Install is via the npm package 'missinglinkz' that exposes the 'mlz' binary—this matches the SKILL.md's npm install instruction and the declared node install spec. npm installs can run arbitrary install scripts (moderate risk by default); this is expected for a CLI distributed via npm but is a standard supply-chain consideration rather than an incoherence.
Credentials
Only one credential is required (MLZ_API_KEY) and it's declared as the primary credential, which is appropriate for a service that offers account-backed features (storage, quota). The single config path requested is reasonable for storing local settings and cached link data.
Persistence & Privilege
No 'always: true' privilege is requested; the skill is user-invocable and may be autonomously invoked by the agent (platform default). The skill will create/use ~/.missinglinkz/config.json to persist its own settings/credentials, which is normal for a CLI tool and within expected scope.
Assessment
This skill appears coherent and implements what it says: a CLI (mlz) distributed via npm that uses a single API key and a local config file. Before installing, verify the npm package and maintainer (search the 'missinglinkz' package on the npm registry and review its source), confirm the homepage (https://missinglinkz.io), and inspect the package contents if you can — npm install scripts can execute arbitrary code during installation. Treat the MLZ_API_KEY like any secret: avoid pasting a production credential until you trust the package, consider creating a scoped/test key if the service supports it, and check ~/.missinglinkz/config.json after first run to see what it stores. If you plan to let an autonomous agent call this skill, be aware the mlz CLI will run commands that act on URLs and may transmit data to the service — limit token permissions and monitor usage. If you want lower risk, run the CLI in an isolated environment/container or review the package source before using it with sensitive accounts.Like a lobster shell, security has layers — review code before you run it.
ai-agentvk97bpgdnb7z3v02t2ef34je7w9832qdkanalyticsvk97bpgdnb7z3v02t2ef34je7w9832qdkcampaign-trackingvk97bpgdnb7z3v02t2ef34je7w9832qdkclivk97bpgdnb7z3v02t2ef34je7w9832qdklatestvk97c7akfp2pqsbmj5yy4hexsk183zar6linksvk97bpgdnb7z3v02t2ef34je7w9832qdkmarketingvk97bpgdnb7z3v02t2ef34je7w9832qdkmcpvk97bpgdnb7z3v02t2ef34je7w9832qdkopenclawvk97bpgdnb7z3v02t2ef34je7w9832qdkseovk97bpgdnb7z3v02t2ef34je7w9832qdkutmvk97bpgdnb7z3v02t2ef34je7w9832qdk
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🔗 Clawdis
Binsmlz
EnvMLZ_API_KEY
Config~/.missinglinkz/config.json
Primary envMLZ_API_KEY
Install
Node
Bins: mlz
npm i -g missinglinkz