Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Pipeworx microlink
v1.0.0Microlink MCP — wraps Microlink API (free tier, no auth required)
⭐ 0· 36·0 current·0 all-time
byBruce Gutman@b-gutman
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill claims to wrap the Microlink API, which can justify a remote connector. However, the SKILL.md requires running 'npx mcp-remote@latest' against a Pipeworx gateway; that runtime code execution and remote connector behavior are not declared in the metadata or install spec and are heavier than the simple description implies.
Instruction Scope
Runtime instructions tell the agent to run npx to fetch and execute 'mcp-remote@latest' and connect to https://gateway.pipeworx.io/microlink/mcp. While the instructions do not request local files or env vars, they direct the agent to download and run arbitrary code and to communicate with an external service — actions beyond a passive API wrapper description.
Install Mechanism
There is no install spec, but the Connect block uses npx to pull and run the latest version of an npm package at runtime. Using unpinned 'latest' via npx means arbitrary code from the public registry will be executed each time — a high-risk install/runtime mechanism.
Credentials
The skill requests no environment variables or credentials, which is proportionate. However, lack of declared credentials does not mitigate risk that downloaded code could exfiltrate data or access network resources.
Persistence & Privilege
The skill does not request 'always: true' and is user-invocable only. It does not declare persistent system changes. The primary concern is runtime code execution rather than elevated platform privileges.
What to consider before installing
This skill asks your agent to run 'npx -y mcp-remote@latest' and connect to a remote Pipeworx gateway, which will download and execute code from npm at runtime. That can run arbitrary code and send data off-host. Before installing: (1) verify the mcp-remote package on the npm registry (author, package contents, recent changes); (2) ask the publisher to pin a specific version or provide an audited package/binary instead of 'latest'; (3) confirm the trustworthiness of https://gateway.pipeworx.io and what data will be sent; (4) if you must test, run it in an isolated sandbox with limited network access; (5) prefer a skill that includes an install spec or bundled code you can review rather than one that executes npx on-demand.Like a lobster shell, security has layers — review code before you run it.
latestvk97a55est059kk3j2sn306y2ex84rjf6
License
MIT-0
Free to use, modify, and redistribute. No attribution required.