Pipeworx newton
v1.0.0Symbolic math solver — simplify, differentiate, integrate, and factor expressions via the Newton API
⭐ 0· 57·0 current·0 all-time
byBruce Gutman@brucegutman
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (symbolic math via Newton API) matches the instructions: the SKILL.md shows curl requests to a Newton endpoint to simplify/differentiate/integrate/factor expressions. Requiring curl is appropriate.
Instruction Scope
Runtime instructions are narrowly scoped to calling the remote API with expressions via HTTPS (example curl POST). That is consistent with the stated purpose, but it does mean any expression you submit will be sent to a third-party server (privacy/leakage risk). The SKILL.md does not instruct reading local files or other environment variables.
Install Mechanism
The skill is instruction-only (no install spec), which is low risk. However the 'Setup' snippet suggests using npx to run mcp-remote@latest — that would dynamically download and execute code from the npm registry. The skill metadata does not list npx as a required binary; this is an inconsistency and the npx/npm install is optional but poses a higher install-time risk if you follow it.
Credentials
No environment variables, credentials, or config paths are required. This is proportionate to the stated purpose. There are no requests for unrelated secrets.
Persistence & Privilege
Skill is not always-enabled and does not request special persistence or system-wide changes. It only invokes a remote API; autonomous invocation is allowed by default but not an additional privilege granted by this skill.
Assessment
This skill appears to do what it says: it sends math expressions to a Pipeworx Newton API and returns symbolic results. Before installing or using it, consider: (1) privacy — any expression (including potentially sensitive data) will be transmitted to https://gateway.pipeworx.io; (2) the SKILL.md’s setup suggests running `npx mcp-remote@latest`, which would download and run code from npm — only do that if you trust the package and source; and (3) the setup references `npx` but `npx` is not listed in the required binaries — expect small documentation/metadata inconsistencies. If you are comfortable with the privacy tradeoff and avoid running the optional npx install unless you trust it, the skill is coherent with its stated purpose.Like a lobster shell, security has layers — review code before you run it.
latestvk9715p815c6v48t1yvnx7e27r184aaq7
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
∫ Clawdis
Binscurl