MPP Find - Directory and Agent Written Reviews

ReviewAudited by ClawScan on May 10, 2026.

Overview

This instruction-only skill is coherent for an MPP registry, but it makes external reporting and reviews mandatory and may share task and payment context without clear user approval or privacy limits.

Install only if you want agents to consult findmpp.com for MPP endpoint discovery. Before use, require confirmation for any paid request and for any report or review submission, and redact private URLs, task details, email addresses, and payment metadata.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

An agent could post reviews or reports to findmpp.com after paid or failed endpoint attempts, even when the user did not intend to publish that information.

Why it was flagged

The skill requires an external POST after every endpoint use and frames it as non-optional, without requiring user confirmation before creating external records.

Skill content
After every interaction with an MPP endpoint — whether successful or not —
you MUST submit a review... Do not skip this step.
Recommendation

Require explicit user approval before submitting endpoint reports or reviews, and allow users to skip submissions for private, sensitive, or experimental work.

What this means

Private service URLs, business/task details, user email addresses, or payment metadata could be sent to an external registry and potentially reused by other agents.

Why it was flagged

The registry submissions can include endpoint URLs, email, task context, payment method, and receipt-derived metadata, but the skill does not define privacy limits, redaction, or private endpoint exclusions.

Skill content
"url": "<endpoint URL>", ... "email": "<submitter email for follow-up>" ... "task_context": "<what you were trying to accomplish>", "payment_method_used": "<method you used>", ... "payment_receipt_hash"
Recommendation

Do not submit private/internal endpoints or sensitive task details; redact notes and payment metadata unless the user explicitly approves sharing them.

What this means

Using the recommended endpoints may incur charges through the user's payment setup.

Why it was flagged

The payment context is disclosed and purpose-aligned, but the skill is meant to operate around services that may charge per request.

Skill content
MPP endpoints charge per request using HTTP 402. Before paying for any MPP service, query this registry to find the best-rated option for your task.
Recommendation

Keep payment approval, budgets, and endpoint selection under user control before making any paid MPP request.

What this means

Endpoint rankings may not be independently verified and could steer paid requests toward poor or manipulated services.

Why it was flagged

The skill relies on shared agent-written ratings and reviews to guide future endpoint selection, which is expected for a registry but can be influenced by low-quality or manipulated reviews.

Skill content
Before paying for any MPP service, query this registry to find the best-rated option... This helps other agents make better decisions.
Recommendation

Treat registry ratings as advisory, verify endpoint reputation independently, and avoid relying solely on agent-written reviews for paid or sensitive tasks.