ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Provenote MCP Outcome Workflows

v1.1.1

Teach an agent to install Provenote's first-party MCP server, connect it in a host, and run read-first outcome workflows.

⭐ 0· 106·0 current·0 all-time
byYifeng[Terry] Yu@xiaojiou176

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiaojiou176/provenote-mcp-outcome-workflows.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Provenote MCP Outcome Workflows" (xiaojiou176/provenote-mcp-outcome-workflows) from ClawHub.
Skill page: https://clawhub.ai/xiaojiou176/provenote-mcp-outcome-workflows
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install provenote-mcp-outcome-workflows

ClawHub CLI

Package manager switcher

npx clawhub@latest install provenote-mcp-outcome-workflows
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
ℹ
Purpose & Capability
The name/description match the instructions: the packet teaches how to install, launch, and wire a first‑party Provenote MCP server and run read‑first workflows. One inconsistency: INSTALL.md lists 'uv' as a required binary and a specific GitHub repo to clone, but the registry metadata reported 'required binaries: none' — the skill will in practice need 'git' and 'uv' (and network access) to follow the install steps.
ℹ
Instruction Scope
SKILL.md and the references clearly confine actions to cloning the Provenote repo, launching its MCP server (via 'uv run provenote-mcp'), editing host MCP config snippets, and performing read-first tool calls (draft.list, research_thread.list, auditable_run.list). The instructions do not ask the agent to read unrelated system files or exfiltrate credentials, but they do require the agent/host to run shell commands and fetch code from an external GitHub repo (https://github.com/xiaojiou176-open/provenote.git).
ℹ
Install Mechanism
This is instruction-only (no install spec), which lowers install-surface risk. However, the INSTALL.md guides cloning an external GitHub repository and running 'uv sync' / 'uv run', which will pull and execute code from that repo — a normal pattern for installing software but one that requires the host reviewer to vet the external source and the 'uv' tool.
✓
Credentials
The skill declares no required environment variables or credentials and its runtime instructions do not reference secrets. It does require filesystem and shell access on the host (editing/pointing configs at a local clone and launching the server), which is appropriate for the stated purpose.
✓
Persistence & Privilege
No elevated platform privileges are requested: always:false, user-invocable, and the packet does not attempt to modify other skills or system-wide agent configs. It only instructs configuring the host's MCP server entries (which is expected).
Assessment
This skill appears coherent for teaching a local Provenote MCP workflow, but before installing you should: (1) verify the provenance of the GitHub repo it asks you to clone (https://github.com/xiaojiou176-open/provenote.git) and review its code, (2) ensure the 'uv' tool and 'git' are available and trustworthy on your host, (3) run the server in an isolated/sandbox environment if possible (it will execute code from the cloned repo), and (4) update the provided OPENCLAW/OPENHANDS config snippets to point only at safe, intended paths. The metadata omission about required binaries (uv/git) is minor but worth correcting; if you cannot review the external repo, avoid launching the server on sensitive infrastructure.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dt1nt1gs838vsey063e4wp584gnfqmcpvk97dt1nt1gs838vsey063e4wp584gnfqnotesvk97dt1nt1gs838vsey063e4wp584gnfqoutcomesvk97dt1nt1gs838vsey063e4wp584gnfqprovenotevk97dt1nt1gs838vsey063e4wp584gnfqresearchvk97dt1nt1gs838vsey063e4wp584gnfq
106downloads
0stars
3versions
Updated 2w ago
v1.1.1
MIT-0
Yifeng[Terry] Yu@xiaojiou176
latestmcpnotesoutcomesprovenoteresearch
Download

Provenote MCP Outcome Workflows

Teach the agent how to install, connect, and use Provenote's first-party MCP server for read-first note and research workflows.

Use this skill when

  • the user wants to turn messy long context into structured drafts or research threads
  • the host can run a local MCP server
  • the user wants inspectable outcomes before broad write automation

What this package teaches

  • how to launch provenote-mcp from a local clone
  • how to wire it into OpenHands or OpenClaw
  • which read-first MCP tools to use first
  • which write actions are narrow and safe to try next

Start here

  1. Read references/INSTALL.md
  2. Load the right host config from:
  3. Skim the tool surface in references/CAPABILITIES.md
  4. Run the demo from references/DEMO.md

Read-first workflow

  1. draft.list
  2. research_thread.list
  3. auditable_run.list
  4. only then move to one narrow write-oriented action

Safe first mutations

  • research_thread.to_draft
  • draft.verify
  • draft.download
  • auditable_run.create
  • auditable_run.download

Suggested first prompt

Use Provenote to inspect the current drafts, research threads, and auditable runs for this workspace. Start with draft.list, research_thread.list, and auditable_run.list. After you summarize what already exists, choose one narrow next step: either convert a research thread into a draft with research_thread.to_draft or verify an existing draft with draft.verify.

Success checks

  • the host can launch provenote-mcp from the provided config
  • the three read-first list calls succeed
  • one narrow mutation succeeds and maps back to an inspectable artifact

Boundaries

  • Provenote stays centered on its first-party MCP server
  • keep outcome claims tied to inspectable repo-owned artifacts

Comments

Loading comments...