Swiggy
v1.0.5Order food, groceries, and book restaurants in India via Swiggy's MCP servers. Food delivery, Instamart groceries, and Dineout restaurant bookings with safety-first confirmation workflow.
⭐ 6· 2.9k·5 current·5 all-time
byNeil Agarwal@regalstreak
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description, README, SKILL.md, package.json and the CLI wrapper all consistently implement a Swiggy MCP client. The declared dependencies (Node.js runtime and the mcporter skill) are appropriate and expected for this functionality.
Instruction Scope
SKILL.md instructs the agent to confirm addresses from USER.md and to append successful orders to memory/swiggy-orders.json, but the provided CLI (swiggy-cli.js) does not read USER.md nor write the memory file. The safety-first confirmation guidance is explicit (good), but some required behaviors described in SKILL.md are not implemented in the shipped code — an operational mismatch to be aware of.
Install Mechanism
No install spec is present (instruction-only plus a single CLI file). The package exposes a CLI via npm link; nothing is downloaded from arbitrary URLs and no extra packages are installed by the skill itself.
Credentials
The skill declares no required environment variables or credentials. Authentication is delegated to mcporter/OAuth (as described). There are no unexpected credential requests in package.json or SKILL.md.
Persistence & Privilege
Skill does not request always:true and does not attempt to modify other skills or system-wide settings. It shells out to mcporter to perform network operations — expected for this use — and relies on mcporter to manage OAuth/session state.
Assessment
This skill appears to do what it says: it wraps mcporter to call Swiggy MCP servers and requires Node and the mcporter skill. Before installing: 1) Note the source/homepage is missing — verify the author or obtain the package from a trusted registry. 2) Ensure you install and trust the mcporter skill, since mcporter will handle OAuth and network access to https://mcp.swiggy.com/*. 3) Be aware SKILL.md promises logging to memory/swiggy-orders.json and address mapping from USER.md but the CLI doesn't implement those; if you rely on those features, inspect/modify the code. 4) The CLI shells out using execSync with JSON-inserted arguments — treat inputs carefully and avoid passing untrusted/unsanitized values. 5) Test in a controlled environment and verify OAuth prompts and account behavior (COD-only and orders reportedly non-cancellable). If you need higher assurance, ask the author for provenance or a signed release, or have a developer review/patch the small mismatches noted above.Like a lobster shell, security has layers — review code before you run it.
latestvk978sfrc1h24gyg9rs0gxadvms805jxc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.