Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Pipeworx chess
v1.0.0Chess.com player profiles, game stats, match archives, and leaderboards from the public API
⭐ 0· 55·0 current·0 all-time
byBruce Gutman@brucegutman
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to use Chess.com's public API (no auth required) and only needs curl — which is consistent. However, instead of calling api.chess.com directly the SKILL.md examples and MCP config point to gateway.pipeworx.io, which is an extra network hop to a third party not mentioned in the description.
Instruction Scope
Instructions are limited and do not ask the agent to read local files or extra environment variables. The concern is that all example calls go to a Pipeworx gateway; using that gateway will transmit query parameters, usernames, and possibly IP/metadata to a third party. The SKILL.md gives no explanation for why a proxy is used or what the gateway does with query data.
Install Mechanism
There is no install spec (instruction-only), which is low risk. The MCP client config example, however, recommends an npx invocation (npx -y mcp-remote@latest ...) which would fetch and execute code from the npm registry at runtime — this is not required by the skill itself but is presented as a client config and could cause unexpected remote code execution if followed.
Credentials
The skill declares no required environment variables, credentials, or config paths — appropriate for a read-only public-API integration.
Persistence & Privilege
No always:true flag and no special privileges requested. The skill is user-invocable and can be invoked autonomously (default), which is normal and not by itself a red flag.
What to consider before installing
This skill appears to do what it says (retrieve public Chess.com data) and only needs curl, but it routes requests through a Pipeworx gateway and suggests using npx to install an MCP client. Before installing or using it: 1) Decide if you trust gateway.pipeworx.io to see query data (usernames, requested months, IP address) — if not, prefer a skill that calls api.chess.com directly. 2) Avoid blindly running the provided npx command; inspect the package (mcp-remote) source or use an alternative client you control. 3) If you must use the gateway, verify TLS, read the gateway's privacy/terms, and test with non-sensitive queries first. 4) If you want a lower-risk option, request or implement a version that calls api.chess.com endpoints directly and documents exactly what is transmitted.Like a lobster shell, security has layers — review code before you run it.
latestvk971tx2e8bzq15gr6w1jfakxfx84dgrm
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
♟️ Clawdis
Binscurl