US Safety Recalls

PassAudited by ClawScan on May 1, 2026.

Overview

This skill coherently adds a remote MCP server for searching public US safety and complaint databases, with no evidence of hidden credentials, local file access, or destructive behavior.

This appears safe for its stated purpose. Before installing, be aware that it adds a remote MCP server and that your search terms may be sent to that endpoint; avoid entering unnecessary personal information.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The agent will rely on a third-party remote MCP service to provide the recall and complaint search tools.

Why it was flagged

The skill is instruction-only and delegates functionality to a disclosed remote MCP endpoint. This is purpose-aligned, but users must trust that remote service as part of the skill's supply chain.

Skill content

mcporter add gov-safety --url https://us-safety-recalls-mcp.apify.actor/mcp --transport streamable-http

Recommendation

Install only if you trust the listed provider and endpoint; review or remove the MCP config entry if you no longer want the remote tools available.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Vehicle, product, company, or complaint search terms may be transmitted to the remote MCP endpoint.

Why it was flagged

The documented setup connects OpenClaw to a remote MCP server over HTTP transport. Search queries sent through the tools may be visible to that remote service.

Skill content

"url": "https://us-safety-recalls-mcp.apify.actor/mcp", "transport": "streamable-http"

Recommendation

Use only the information needed for public-database searches and avoid including unnecessary personal or sensitive details in queries.