Pixcake Skills
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill appears to do what it claims (drive local PixCake client actions) and its scripts are consistent with that purpose, but the included setup scripts will search your disks, write a mcporter config file in your home directory and may install mcporter via npm (network/global install) — so review and run the setup steps consciously.
This skill is internally coherent for controlling a local PixCake client, but before installing or running its setup: (1) review the included setup.sh / setup.ps1 scripts (they are provided) so you understand the filesystem probes and the config write to ~/.openclaw/workspace/config/mcporter.json; (2) be aware the scripts may run npm install -g mcporter (network download and global install) — ensure your npm registry and environment are trusted; (3) prefer to run the scripts in check-only mode first (./scripts/setup.sh --check-only or .\scripts\setup.ps1 -CheckOnly) to see what would change; (4) if you are on Windows, note the shipped file is setup.ps1.txt and must be renamed before execution; and (5) if you’re uncomfortable with global npm installs or the script's filesystem scanning, skip automatic setup and configure mcporter/mcp manually following the references/mcp-setup.md guidance.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.