Plati MCP Search

• Risk level: Low Risk
• Analyzed: May 1, 2026, 6:00 AM
• Findings: 1
• Version: 0.1.6

Overview

The skill is coherent for Plati marketplace search and does not request credentials, but it relies on installing and configuring an unpinned external MCP server package.

This appears safe for its stated search purpose, but install the MCP server only if you trust the npm package. Review the package source or reputation first, prefer a pinned version, and avoid putting private information into marketplace search queries.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI04: Agentic Supply Chain Vulnerabilities

Note

What this means

Installing the skill as instructed would require trusting the external npm package that provides the MCP server.

Why it was flagged

The skill depends on a globally installed external npm package and local MCP server configuration. This is consistent with the skill's stated purpose, but the package is unpinned and not included in the reviewed artifacts.

Skill content

Prerequisite: install the MCP server package:

`npm i -g plati-mcp-server`

Configure an MCP server named `plati-scraper` ... `command: plati-mcp-server`

Recommendation

Verify the `plati-mcp-server` npm package, maintainer, and version before installing; pin a trusted version if possible and remove the MCP configuration when no longer needed.