Hekkova Openclaw Skill

This skill appears coherent for its stated purpose and only asks for a single API key and npx. Before installing, verify the following: (1) Confirm the MCP endpoint (https://mcp.hekkova.com/mcp) and the `mcp-remote` package are legitimate — running `npx mcp-remote` will download and execute code from npm at runtime, which is a supply-chain risk; prefer a pinned, audited package or a vetted local binary if possible. (2) Limit the scope and lifetime of HEKKOVA_API_KEY (use a key with least privilege, store it securely, and rotate it if you suspect compromise). (3) Understand that media passed to the skill (base64 or URLs) and optional provenance metadata will be sent to Hekkova infrastructure and that privacy depends on their encryption/hosting claims — verify their docs and terms before uploading sensitive content. (4) If you want to reduce risk, avoid enabling autonomous agent invocation for this skill or require explicit user confirmation before any minting operations. If you need higher assurance, request or inspect a pinned, published `mcp-remote` release (or vendor the bridge) so the code executed by npx can be audited.