Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

mila

Create, read, update, and delete documents, spreadsheets, and slide presentations in Mila via the REST API or MCP tools. Use when the user wants to manage co...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 17 · 0 current installs · 0 all-time installs
byfred@freddyjd
MIT-0
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The SKILL.md repeatedly states the skill needs a Mila API key (format mila_sk_*) and network access to api.mila.gg / mcp.mila.gg to function. However, the registry metadata lists no required environment variables or primary credential. That mismatch is unexpected for an API-integration skill and suggests the metadata is incomplete or inconsistent.
Instruction Scope
The instructions are focused on calling Mila's REST API and configuring MCP clients. They do not instruct the agent to read unrelated system files, secret locations, or to exfiltrate data to third-party endpoints — scope is limited to Mila endpoints and local MCP config examples.
Install Mechanism
This is an instruction-only skill with no install spec and no code files to write to disk, which minimizes installation risk.
!
Credentials
Functionality requires an API key (per SKILL.md) but the skill does not declare any required env vars or a primary credential in the registry metadata. That omission prevents the platform from prompting for/storeing the credential appropriately and is disproportionate to the documented purpose (it should declare mila_sk_* as a primary credential or require env var).
Persistence & Privilege
The skill is not force-included (always:false) and does not request elevated or persistent system privileges. Autonomous invocation is allowed by default but not combined with other high-risk indicators here.
What to consider before installing
This skill appears to be a legitimate API client for Mila, but the registry metadata is inconsistent: the documentation requires a Mila API key while the skill does not declare any required credential. Before installing, confirm how and where you'll provide the API key (do not paste it into chat). Prefer providing the key via the platform's secure skill-credential UI or a protected environment variable, and limit its scopes (documents:read/write, sheets:read/write, slides:read/write) to only what's necessary. Verify the domain https://mila.gg and the API endpoints (api.mila.gg / mcp.mila.gg) are the official service you expect. If you need to use this skill but the platform will not prompt for a credential, ask the skill publisher or registry admin to update metadata to declare a primary credential so the platform can handle the key securely.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.2
Download zip
latestvk97d80y8jjc029a8t415cjg2f583x7b5

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Mila

Mila is a collaborative platform for documents, spreadsheets, and slide presentations. This skill teaches you how to interact with Mila's REST API and MCP tools to manage content programmatically.

Get started at https://mila.gg -- create an account, generate an API key, and start building.

Authentication

All requests require a Mila API key. Keys use the format mila_sk_*.

API keys have scopes that control access (e.g. documents:read, documents:write, sheets:read, sheets:write, slides:read, slides:write).

REST API authentication

Include the API key as a Bearer token:

Authorization: Bearer mila_sk_your_key_here

Base URL: https://api.mila.gg/v1

MCP authentication

The MCP server uses the same API keys. Include the key in the Authorization header when connecting to the MCP endpoint.

MCP endpoint: https://mcp.mila.gg

MCP setup

If the user wants to connect Mila to an AI client via MCP, use these configurations:

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "mila": {
      "url": "https://mcp.mila.gg",
      "headers": {
        "Authorization": "Bearer mila_sk_your_key_here"
      }
    }
  }
}

Cursor (.cursor/mcp.json):

{
  "mcpServers": {
    "mila": {
      "url": "https://mcp.mila.gg",
      "headers": {
        "Authorization": "Bearer mila_sk_your_key_here"
      }
    }
  }
}

VS Code Copilot (.vscode/mcp.json):

{
  "servers": {
    "mila": {
      "type": "http",
      "url": "https://mcp.mila.gg",
      "headers": {
        "Authorization": "Bearer mila_sk_your_key_here"
      }
    }
  }
}

Quick start

Create a document

curl -X POST https://api.mila.gg/v1/documents \
  -H "Authorization: Bearer mila_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"title": "Meeting Notes", "content": "<h1>Meeting Notes</h1><p>Discussed roadmap.</p>"}'

MCP tool: create_document with title and content (HTML string).

Create a spreadsheet

curl -X POST https://api.mila.gg/v1/sheets \
  -H "Authorization: Bearer mila_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"title": "Budget", "cells": {"A1": {"value": "Item"}, "B1": {"value": "Cost"}, "A2": {"value": "Hosting"}, "B2": {"value": 99}}}'

MCP tool: create_sheet with title and cells (A1 notation object).

Create a presentation

curl -X POST https://api.mila.gg/v1/slides \
  -H "Authorization: Bearer mila_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"title": "Demo", "data": [{"html": "<div style=\"display:flex;align-items:center;justify-content:center;height:100%\"><h1 style=\"font-size:48px\">Hello</h1></div>", "background": "#ffffff", "notes": "Title slide"}]}'

MCP tool: create_slide_presentation with title and data (array of slide objects).

API conventions

IDs

All resource IDs are opaque strings (e.g. "xK9mP2wQ"). Use them as-is in URLs and parameters.

Pagination

List endpoints accept limit (1-100, default 50) and offset (default 0). Responses include a pagination object:

{
  "data": [...],
  "pagination": { "total": 42, "limit": 50, "offset": 0 }
}

Sorting

List endpoints accept sort (created_at, updated_at, last_edited_at, title) and order (asc, desc).

Server filtering

Content can belong to a server (workspace) or to personal files.

  • Omit server_id: returns all content
  • server_id=personal: returns only personal files
  • server_id=<id>: returns content in that server

Pass server_id in the request body when creating content to place it in a server. Omit for personal files.

Response format

All responses use this structure:

{
  "success": true,
  "data": { ... }
}

Errors return:

{
  "success": false,
  "error": { "message": "Description of the error" }
}

Content formats

  • Documents: HTML strings (headings, paragraphs, lists, tables, images, links). <script> tags are stripped.
  • Sheets: Cell data in A1 notation (e.g. {"A1": {"value": "Name"}, "B1": {"value": 42}}). Formulas start with =.
  • Slides: Free-form HTML on a 960x540px canvas. Each slide has html, background, and notes fields.

Detailed references

For complete endpoint documentation with all parameters, response shapes, and examples:

Available MCP tools

ToolDescription
list_serversList all servers (workspaces)
list_documentsList documents with pagination and filtering
get_documentGet a document with full content
create_documentCreate a document with HTML content
update_documentUpdate title and/or content
delete_documentDelete a document
append_to_documentAppend HTML to a document
list_sheetsList workbooks with tab metadata
get_sheetGet a workbook with all tabs and cells
create_sheetCreate a workbook with an initial tab
update_sheetUpdate workbook title
delete_sheetDelete a workbook and all tabs
get_sheet_tabGet a single tab with cell data
create_sheet_tabAdd a tab to a workbook
update_sheet_tabUpdate cells, name, color, or grid size
delete_sheet_tabRemove a tab from a workbook
append_rowsAppend rows of data to a tab
list_slidesList presentations
get_slide_presentationGet a presentation with all slides
create_slide_presentationCreate a presentation
update_slide_presentationUpdate title, slides, theme, or aspect ratio
delete_slide_presentationDelete a presentation
append_slidesAdd slides to a presentation

Learn more

Files

5 total
Select a file
Select a file to preview.

Comments

Loading comments…