ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

ops-mcp-server

v1.0.3

Query observability data and execute operational procedures via the ops-mcp-server MCP interface. Covers Kubernetes events, Prometheus metrics, Elasticsearch...

⭐ 1· 479·1 current·1 all-time
byShaowen Chen@shaowenchen
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
The skill's name, description and tool names align with querying events, metrics, logs, traces and listing/executing SOPS via an MCP interface. SOPS (procedures) are a legitimate part of an ops skill, but the README/SKILL.md also states 'NOT For Direct infrastructure changes' while providing examples that execute potentially destructive SOPS (restart-node, db-migrate, scale-deployment). This is a contradictory design choice that should be clarified.
!
Instruction Scope
The SKILL.md instructs the agent/user to run mcporter commands (npx mcporter ...) and to add an Authorization header in ~/.openclaw/workspace/config/mcporter.json if auth fails. It also includes explicit examples for execute-sops-from-ops that perform actions (restart, scale, db migrate). Those instructions give the agent a direct path to trigger infrastructure changes via the user's configured MCP server. The docs reference local config files and environment variables (OPS_MCP_SERVER_URL, EVENT_CLUSTER) and encourage setting tokens — all of which expand the skill's I/O surface beyond read-only investigation.
✓
Install Mechanism
This is an instruction-only skill (no install spec, no code files). That is the lowest install risk: nothing is downloaded or written by the skill package itself. The runtime behavior depends on the user's mcporter CLI and the remote MCP server the user configures.
!
Credentials
Registry metadata lists no required env vars or credentials, but SKILL.md and design.md reference OPS_MCP_SERVER_URL and EVENT_CLUSTER and ask the user to add an Authorization header (Bearer token) to mcporter.json. The skill therefore expects credentials/config but does not declare them. That mismatch is important: the agent instructions assume access to tokens and config files without declaring them, and those tokens grant the ability to call the MCP server (including SOPS execution).
ℹ
Persistence & Privilege
The skill is not marked always:true and uses the platform default (agent may invoke it autonomously). Autonomous invocation combined with the ability to execute SOPS increases blast radius: an agent could autonomously call execute-sops-from-ops if given permission to the MCP. This is not automatically malicious but elevates risk and should be mitigated by restricting token scope and requiring confirmations/auditing for SOPS runs.
What to consider before installing
Key things to consider before installing/using this skill: - It is instruction-only and does not ship code, but it instructs the agent (and you via examples) to use mcporter configured to call an MCP endpoint. That endpoint is where actions actually run — review and trust the MCP server before connecting. - The documentation references and uses environment/config values (OPS_MCP_SERVER_URL, EVENT_CLUSTER) and an Authorization token in ~/.openclaw/workspace/config/mcporter.json, but the skill metadata does not declare required env vars or credentials. Treat this as a gap: expect to supply sensitive tokens to mcporter if you want the skill to operate. - The skill contains examples that call execute-sops-from-ops (restart-node, db-migrate, scale-deployment). Those examples can modify infrastructure. If you want only read-only investigation, ensure the token you provide has read-only scope, or disable/guard SOPS execution on the MCP server. - Before enabling: (1) verify the MCP endpoint URL and ownership; (2) limit token scope and lifetime (use a token that cannot execute destructive SOPS if possible); (3) require manual confirmation for SOPS execution or remove execute-sops privileges; (4) test in a staging environment; (5) audit mcporter logs and MCP audit trails so any SOPS call is visible and attributable. - If you are concerned about autonomous agent behavior, consider disabling autonomous invocation of this skill for agents that should not perform actions, or ensure the agent prompts a human before any execute-sops call. - Finally, ask the publisher to clarify the contradiction between 'not for direct infrastructure changes' and the SOPS execution examples, and to declare required environment variables and recommended token scopes in the registry metadata.

Like a lobster shell, security has layers — review code before you run it.

latestvk9774f0d5xkbcjs8p38w84rxgx829mda

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments