Pipeworx pokemon
PassAudited by ClawScan on May 10, 2026.
Overview
This appears to be a simple Pokémon lookup MCP skill, but users should notice that it connects through a remote Pipeworx gateway using an unpinned npm package.
This skill looks coherent for Pokémon lookups and does not request credentials. Before installing, be aware that it uses a remote Pipeworx MCP gateway and an unpinned npm bridge package; only use it if you trust those providers, and keep queries non-sensitive.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill may run code fetched through npm and rely on a remote service whose behavior can change after installation.
The connection command runs an unpinned latest npm package and connects to a hosted gateway. This is disclosed and purpose-aligned, but package or gateway changes could affect future behavior.
"command": "npx", "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/pokemon/mcp"]
Prefer a pinned mcp-remote version if supported, and install only if you trust the Pipeworx gateway and npm package source.
Pokémon lookup queries may be visible to the remote MCP provider.
The skill routes MCP tool calls through a remote provider endpoint. This is expected for the stated MCP wrapper, but it means user queries sent to the tool go to that provider.
"https://gateway.pipeworx.io/pokemon/mcp"
Use it for non-sensitive Pokémon lookups, and avoid sending private or unrelated information through this MCP server.