ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Cloud Phone Agent

v0.0.2

Use mcporter to call cpc-mcp-server AutoJS Agent tools for cloud Android task execution and result retrieval.

⭐ 0· 1k·1 current·1 all-time
by@sav7ng
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The skill describes cloud Android automation via cpc-mcp-server and only requires the mcporter CLI plus a single API key (CLOUDPHONE_API_KEY). Those requirements are proportionate and expected for a skill that routes requests through a generic MCP caller.
ℹ
Instruction Scope
SKILL.md confines instructions to using mcporter to call cpc-mcp-server tools and to set Authorization: Bearer <API_KEY>. It does not instruct reading unrelated files or other environment variables. However, the mcporter tool supports arbitrary HTTP/stdio calls and JSON args — so the agent will be capable of transmitting user-provided scripts/data to remote endpoints (expected for this use-case, but a potential data-exfiltration vector if misused).
ℹ
Install Mechanism
Install is an npm/node package ('mcporter'). Using a public npm package is a reasonable choice but carries typical registry risks (supply-chain/malicious publish). The skill metadata does not include a homepage/source URL beyond a README hint; verify the npm package identity and provenance before installing.
✓
Credentials
Requires a single credential, CLOUDPHONE_API_KEY, which directly maps to the described Authorization header use. No unrelated secrets or multiple credentials are requested.
✓
Persistence & Privilege
No special persistence requested (always:false). The skill is user-invocable and can be invoked autonomously by the agent (platform default) but does not request elevated agent-wide privileges or modify other skills/config.
Assessment
This skill appears internally consistent: it needs the mcporter CLI and an API key to call cpc-mcp-server and run AutoJS tasks. Before installing, verify the 'mcporter' npm package comes from a trusted publisher (check the package page, maintainer, and recent release history); ensure CLOUDPHONE_API_KEY has the least privileges necessary and is scoped/rotated; avoid passing sensitive secrets or PII in task instructions; and consider limiting autonomous use (or requiring user confirmation) if you don't want the agent to call remote devices without explicit approval.

Like a lobster shell, security has layers — review code before you run it.

latestvk9709ephs8qdjsjpk0p2gnsfts80xapr

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📱 Clawdis
Binsmcporter
EnvCLOUDPHONE_API_KEY
Primary envCLOUDPHONE_API_KEY

Install

Install mcporter (node)
Bins: mcporter
npm i -g mcporter

Comments