Firm Spec Compliance Pack

MCP 2025-11-25 specification compliance audit pack. Validates elicitation, tasks, resources/prompts, audio content, JSON Schema 2020-12, SSE transport, and i...

Security Scan

The skill is an instruction-only compliance audit pack that is internally consistent with its stated purpose and requests no credentials or installs, but you should verify the required mcp-openclaw-extensions dependency and avoid pointing it at sensitive config files.

Purpose & Capability

The SKILL.md describes an MCP protocol compliance audit pack and declares a dependency on mcp-openclaw-extensions >= 3.0.0; the listed CLI-style tools and config_path usage are coherent with an auditing toolset.

Instruction Scope

Instructions are limited to running audit tools against a user-specified config_path and adding the skill to the agent config. This is appropriate for a compliance pack, but the runtime will read whatever file you point to — do not point it at system or secret-containing config files without review.

Install Mechanism

No install spec or code files are included (instruction-only), which reduces risk. However the declared dependency (mcp-openclaw-extensions >= 3.0.0) implies external tooling will be required; the skill provides no source or install instructions for that dependency, so verify where you obtain it.

Credentials

The skill requests no environment variables, credentials, or config paths itself. The only resource it references is a user-supplied config_path for audits, which is proportionate to its purpose. Be aware the required extension may itself request credentials or env vars.

Persistence & Privilege

always:false and default autonomous invocation are in place; the skill does not request elevated or persistent privileges or modify other skills. No indications it would persist beyond normal skill inclusion.

Assessment

This SKILL.md is instruction-only and aligns with an MCP compliance audit pack. Before installing: 1) Verify and obtain the mcp-openclaw-extensions >= 3.0.0 from a trusted source (the skill gives no homepage or installer). 2) Inspect the extension's code/packaging so you know what those openclaw_* audit commands do and whether they install additional software. 3) When running the audits, point config_path to non-sensitive test or exported copies of your config — don't use paths containing secrets or system-wide credentials. 4) Run the audits in an isolated environment (or with least privilege) until you confirm the extension and tools are trustworthy. If you want extra assurance, ask the extension author/source for provenance or source code before enabling the skill in production.

⚠️ Contenu généré par IA — validation humaine requise avant utilisation.

Purpose

Audit pack ensuring full compliance with MCP specification version 2025-11-25. Covers all new protocol features introduced since 2025-03-26.

Tools (7)

Tool	Description	Severity
openclaw_elicitation_audit	Validate elicitation flow implementation	HIGH
openclaw_tasks_audit	Check tasks/durable requests support	HIGH
openclaw_resources_prompts_audit	Verify resources & prompts capabilities	MEDIUM
openclaw_audio_content_audit	Audio content type support validation	MEDIUM
openclaw_json_schema_dialect_check	JSON Schema 2020-12 dialect compliance	HIGH
openclaw_sse_transport_audit	SSE transport + resumption validation	HIGH
openclaw_icon_metadata_audit	Icon metadata format verification	LOW

Usage

# In your agent configuration:
skills:
  - firm-spec-compliance-pack

# Run full compliance check:
openclaw_elicitation_audit config_path=/path/to/config.json
openclaw_tasks_audit config_path=/path/to/config.json
openclaw_resources_prompts_audit config_path=/path/to/config.json
openclaw_json_schema_dialect_check config_path=/path/to/config.json
openclaw_sse_transport_audit config_path=/path/to/config.json
openclaw_icon_metadata_audit config_path=/path/to/config.json

Spec Coverage

• Elicitation (SEP-032): Server-initiated user input requests
• Tasks (SEP-044): Long-running durable operations with status tracking
• Resources/Prompts: Capability declaration and handler completeness
• Audio Content: Binary audio type support in messages
• JSON Schema 2020-12: Dialect URI and vocabulary compliance
• SSE Transport: Event streaming with Last-Event-ID resumption
• Icons: URI format, media type validation, and accessibility

Requirements

• mcp-openclaw-extensions >= 3.0.0
• MCP Protocol Version: 2025-11-25