ClawHub

Pipeworx catfacts

v1.0.0

Random cat facts and breed information from the Cat Facts API

⭐ 0· 54·0 current·0 all-time
byBruce Gutman@brucegutman
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the instructions: SKILL.md only describes fetching random cat facts and breed info via an external API/gateway. Requiring curl is proportionate to the documented examples.
✓
Instruction Scope
Runtime instructions limit activity to calling the Cat Facts API / the pipeworx gateway (example curl and MCP config). The skill does not instruct the agent to read local files, environment variables, or unrelated system state.
ℹ
Install Mechanism
There is no install spec (instruction-only), which is low risk. Documentation includes an MCP config that uses `npx mcp-remote@latest ...` — if followed this would download and execute an npm package at runtime; that is not required by the skill itself but is a potential operational risk the user should be aware of.
✓
Credentials
No environment variables, secrets, or config paths are requested. This is proportionate for a read-only data/lookup skill.
✓
Persistence & Privilege
always is false and the skill does not ask to modify other skills or system-wide agent settings. It does propose connecting to an external MCP gateway, which is normal for a remote tool integration.
Assessment
This skill appears to do exactly what it says: fetch cat facts and breed data. It does not request credentials or local file access. Two practical cautions before you enable it: (1) the examples call an external endpoint (gateway.pipeworx.io) — using the skill will cause network requests to that service, so only enable it if you trust that endpoint and your environment's outbound network policies; (2) the MCP example uses `npx mcp-remote@latest`, which would download and run code from npm if you configure it that way — prefer pinned versions, review the package, or run that helper in a sandbox. If you need higher assurance, ask the publisher for the API contract or host the connector code in a controlled environment.

Like a lobster shell, security has layers — review code before you run it.

latestvk974e0aj1evg5y9et3w8dy5tm584d943

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🐱 Clawdis
Binscurl

Comments