X Webmcp

This skill appears to do what it says (drive X via a local webmcp adapter), but there are a few things to check before installing or enabling it: - Verify prerequisites yourself: SKILL.md requires 'uxc' and 'npx' on PATH and Playwright browsers installed (npx playwright install). The registry metadata does not list these—ensure they are present and trustworthy. - Confirm the x-webmcp-cli binary origin: the skill runs that CLI and delegates to webmcp-bridge scripts. Make sure x-webmcp-cli and the referenced webmcp-bridge code come from a source you trust. - Protect your session data: the skill uses a managed profile path (~/.uxc/webmcp-profile/x). Use a dedicated/isolated profile for this skill (do not point it at your primary browser profile) because the tool can access cookies, tokens, and local files used for uploads. - Review the repository layout if installing from a package: ensure the referenced sibling scripts (skills/webmcp-bridge/...) exist locally; otherwise the ensure-links.sh wrapper may fail or call unexpected code. - Be cautious with autonomous invocation: allow_implicit_invocation is enabled; if you permit the agent to call skills autonomously, it could access the local profile without an interactive prompt. If you want stricter control, disable autonomous use or require explicit user confirmation for write actions. - If you need higher assurance, run the included validate.sh locally (it needs 'rg' / ripgrep) and inspect x-webmcp-cli and webmcp-bridge code before granting it any privileges.