Mcp Client

• Analyzed: May 12, 2026, 4:34 AM
• Findings: 1
• Version: 1.0.3
• Hash: 6bb791de7c2603f2c431c9b0cd5afa3d2a0dd02ea6feb9d92415f89319611f9f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills bundle implements a client for the Model Context Protocol (MCP). The code in `mcp_client.py` and the documentation in `SKILL.md` are straightforward, focusing on connecting to a remote MCP server, listing/calling tools, and accessing resources. Both files explicitly warn about the `file://` URI scheme, clarifying that it allows reading local files from the *MCP server* (the remote endpoint), not from the agent's local machine. There is no evidence of malicious intent, data exfiltration from the agent's host, unauthorized execution, persistence mechanisms, or prompt injection attempts against the agent. The skill functions as a legitimate client for a defined protocol.