ClawHub

lithtrix-skills-api

v1.0.1

Operate Lithtrix (lithtrix.ai) from an agent — self-serve API keys, credibility-scored web discovery, per-agent JSON memory, MCP tools, and free-tier referra...

⭐ 0· 50·0 current·0 all-time
by@learningloons-hash
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description, required env var (LITHTRIX_API_KEY), and required binary (curl) all match the documented Lithtrix API usage (discover, register, search, memory, MCP). There are no unrelated credentials or binaries requested.
✓
Instruction Scope
SKILL.md gives explicit API calls (curl) and describes endpoints, registration flow, and memory endpoints. It does not instruct the agent to read unrelated files, harvest other environment variables, or exfiltrate data. It does mention an optional LITHTRIX_API_URL override and shows using npx for the MCP tool (see install_mechanism note).
ℹ
Install Mechanism
This is an instruction-only skill with no install spec or local code. The docs recommend running `npx -y lithtrix-mcp` to run an MCP server — that is a direct instruction to fetch & execute an npm package at runtime, which is functionally appropriate for providing MCP tooling but carries the usual remote-code-execution risk of npx. No other downloads, extract steps, or third-party, non-Lithtrix URLs are present.
✓
Credentials
Only LITHTRIX_API_KEY is required and declared as the primary credential; an optional LITHTRIX_API_URL override is documented but not listed as required. The requested environment access is proportional to the skill's purpose.
✓
Persistence & Privilege
Skill is not forced-always, does not request persistent system-wide privileges, and does not modify other skills' configurations. Autonomous invocation is allowed by default (normal for skills).
Assessment
This skill appears coherent and only needs your Lithtrix API key and curl to operate. Before installing or enabling it: keep your ltx_ key secret (do not paste into public logs), be aware the docs instruct running `npx -y lithtrix-mcp` which will fetch and run code from the npm registry (normal for MCP but higher-risk than pure curl calls), and verify the publisher/homepage you trust (https://docs.lithtrix.ai). If you want higher assurance, ask for the skill's source or an official registry entry and avoid running npx unless you trust the package maintainer.

Like a lobster shell, security has layers — review code before you run it.

latestvk973f143xqxq21vh3ahtdbsm9n84yabs

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🌍 Clawdis
Any bincurl
EnvLITHTRIX_API_KEY
Primary envLITHTRIX_API_KEY

Comments