ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

DeepWiki MCP Skill

v1.0.0

Ask questions and read documentation about any GitHub repository using DeepWiki MCP. Use when you need to understand a codebase, find specific APIs, or get c...

⭐ 0· 336·2 current·2 all-time
by@jolestar
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (DeepWiki MCP Skill) match the runtime instructions: the skill instructs the agent to call a DeepWiki MCP endpoint via the uxc CLI or a linked fixed command. Required artifacts (uxc binary, network access to mcp.deepwiki.com) are appropriate for this purpose.
✓
Instruction Scope
SKILL.md only instructs discovery of the deepwiki-mcp-cli command, creating a uxc link, and invoking read/ask operations against the MCP endpoint. It does not direct the agent to read unrelated local files, environment variables, or transmit data to unexpected endpoints. It does require network access to mcp.deepwiki.com (documented).
ℹ
Install Mechanism
The skill is instruction-only (no install spec). It recommends installing the third-party 'uxc' tool via Homebrew, cargo, or an install script hosted on raw.githubusercontent.com. Recommending a curl-download-and-run script is common but carries the usual review risk — SKILL.md explicitly tells users to review the script before running.
✓
Credentials
No environment variables, credentials, or config paths are requested. The operations only need a CLI binary and network access to the documented MCP host; this is proportionate to the skill's function.
✓
Persistence & Privilege
The skill is not always-enabled and does not request elevated or persistent system-wide privileges. It does instruct creating a fixed command alias via 'uxc link', which affects the user's PATH/command resolution scope but is limited to linking the MCP host to a CLI name and is documented in the SKILL.md.
Assessment
This skill appears internally consistent: it only needs the uxc CLI and network access to mcp.deepwiki.com to query indexed GitHub repos. Before installing/use: (1) confirm you trust and are willing to allow network calls to mcp.deepwiki.com, (2) review any install script from raw.githubusercontent.com before running it, and (3) be aware the skill suggests creating a linked CLI name (deepwiki-mcp-cli) which will add a command entry via uxc link and could shadow an existing command. No secrets or unrelated system access are requested.

Like a lobster shell, security has layers — review code before you run it.

latestvk972e0z5smmm688b2f7e135ws58278ac

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments