Board Webmcp
v0.1.1Connect to the native board demo through local-mcp and one fixed UXC link. Use when the user wants to inspect or edit the shared board at board.holon.run or...
⭐ 0· 141·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill's name/description (connect to board via local-mcp/UXC) matches the included scripts and SKILL.md. However, registry metadata lists no required binaries/env, while the SKILL.md and scripts clearly require 'uxc' and 'npx' (and recommend Playwright browsers). This mismatch is an implementation inconsistency but not evidence of malicious intent.
Instruction Scope
Instructions are focused on creating/updating a UXC link and using board-webmcp-cli to read/write board state. They instruct the agent/user to run scripts/ensure-links.sh which writes a profile under $HOME (~/.uxc/webmcp-profile/board) and registers a daemon link. The skill does not ask for unrelated files or credentials, but it does create persistent user data and launches/links to an npm package at runtime.
Install Mechanism
There is no formal install spec (instruction-only). At runtime the helper uses npx to invoke @webmcp-bridge/local-mcp, which will dynamically fetch and run code from the npm registry. Using npx is expected for this use-case but increases risk vs. a pinned or audited binary because it downloads code at execution time.
Credentials
The skill does not request credentials or sensitive env vars. It does write to $HOME and uses optional env overrides (WEBMCP_LOCAL_MCP_COMMAND, WEBMCP_DAEMON_IDLE_TTL). No unrelated service keys are requested, so the requested environment access is proportionate to its purpose.
Persistence & Privilege
The helper script registers a UXC link and (by default) a daemon profile under the user's home directory and can create a persistent background runtime (--daemon-exclusive profile). The skill itself is not always: true and will not auto-install unless run, but running the script can create persistent background behavior the user should be aware of.
Assessment
This skill is coherent with its stated purpose, but review and take these precautions before running it: 1) The SKILL.md and scripts require 'uxc' and 'npx' (and optionally Playwright); the registry metadata incorrectly omitted those requirements—install those tools first. 2) ensure-links.sh uses 'npx' to fetch @webmcp-bridge/local-mcp at runtime; prefer to inspect or pin that package (or vendor it locally) before allowing dynamic npx installs. 3) The script creates a profile directory (~/.uxc/webmcp-profile/board) and registers a daemon/link which may persist and run in the background—run it in an isolated HOME or test environment if you want to avoid side effects. 4) If you need stronger assurance, run the included scripts/validate.sh and manually inspect the npm package source for @webmcp-bridge/local-mcp before use. 5) Do not provide any unrelated credentials; this skill does not require them.Like a lobster shell, security has layers — review code before you run it.
latestvk972swqfs1h7w2a1e0k1znbyp983ga92
License
MIT-0
Free to use, modify, and redistribute. No attribution required.