reMarkable MCP
v0.8.0Access reMarkable tablet documents, notebooks, PDFs, and EPUBs. Use when the user wants to read, search, browse, or extract text from their reMarkable tablet...
⭐ 0· 232·0 current·0 all-time
bySam Morrow@sammorrowdrums
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to access reMarkable content (reading, OCR, rendering), and the instructions show how to run a local 'remarkable-mcp' server in USB/SSH/cloud modes — that is coherent with the stated purpose. However, the skill metadata lists no required binaries or env vars, yet the SKILL.md expects 'uvx' and 'remarkable-mcp' on PATH and optional env vars (REMARKABLE_TOKEN, GOOGLE_VISION_API_KEY). The missing declaration of these runtime requirements is an incoherence.
Instruction Scope
Instructions are scoped to device access (USB web interface, SSH, or cloud) and OCR. They do not ask the agent to read unrelated host files or credentials. Still, they instruct the user/agent to run an external local binary that will access the tablet and potentially upload data for cloud/Google Vision OCR; that behavior is within the skill's stated purpose but should be explicit and provenance verified.
Install Mechanism
There is no install spec and no code files, yet the runtime requires binaries ('uvx' and 'remarkable-mcp'). Without an install source, users would have to obtain and run these binaries themselves — lack of download/source/homepage or checksums increases risk because the origin and integrity of the required software are unknown.
Credentials
The SKILL.md references environment variables appropriate for the tasks (REMARKABLE_TOKEN for cloud, GOOGLE_VISION_API_KEY for OCR), but the skill metadata declares no required env vars. This mismatch is problematic: sensitive keys are needed for full functionality but were not declared in metadata, so automated checks or users may miss that secrets will be used. The vars themselves are proportionate to the feature set, but the omission is concerning.
Persistence & Privilege
The skill is not forced-always and is user-invocable; it will not be force-included in every agent run. Normal autonomous invocation is allowed but not excessive here.
What to consider before installing
Before installing or using this skill, verify the provenance of the required binaries ('uvx' and 'remarkable-mcp'): ask the publisher for a homepage or source repository, installation instructions, and checksums/signing. Understand that running the tool will access your reMarkable device and — if you enable cloud mode or provide a GOOGLE_VISION_API_KEY — may send content to remote services for OCR. Only provide REMARKABLE_TOKEN or Google API keys if you trust the binary's source. Because the SKILL.md lists runtime requirements but the package metadata does not, treat this as a sign the package was incompletely described; request clear install/source information before proceeding.Like a lobster shell, security has layers — review code before you run it.
latestvk972e1j643stksfa5wrxs4a9nn8287ee
License
MIT-0
Free to use, modify, and redistribute. No attribution required.