Meegle Mcp

This skill mostly does what it says (an MCP proxy to Meegle), but there are a few red flags to consider before installing: - The skill actually needs two secrets (MEEGLE_USER_KEY and MEEGLE_MCP_KEY), but the registry only declared MEEGLE_USER_KEY. Expect to provide both keys. - setup.sh writes those keys into your shell profile (~/.bashrc, ~/.zshrc) in plain text. If you are concerned about storing secrets on disk, don’t run the script; instead store keys in a secure vault or use OpenClaw's secure config mechanism. - The proxy embeds both keys in the request URL query string when contacting the MCP endpoint. Even over HTTPS, query parameters can be logged by servers or intermediaries. If possible, prefer sending credentials in headers or bearer tokens, or confirm that your MCP server is comfortable with query-based auth and logs are acceptable. - The proxy prints a fragment of your user key to stderr on startup (useful for debugging), which could end up in logs; be aware of log exposure. - If you proceed, prefer a dedicated, least-privilege service account for automation, rotate keys after testing, and review the mcp-proxy.js and setup.sh code yourself or with a trusted admin. If you want to be cautious: refuse or modify the setup script (avoid writing secrets to shell profiles), add MEEGLE_MCP_KEY to the skill metadata or verify with the publisher, and consider using a secure secrets store instead of environment variables in shell files.