Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Skylv Mcp Server Builder

v1.0.3

MCP (Model Context Protocol) 服务器开发助手。从零构建 MCP 服务器、工具、提示模板。触发词:mcp、服务器、协议、工具构建。

0· 146·0 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for sky-lv/skylv-mcp-server-builder.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Skylv Mcp Server Builder" (sky-lv/skylv-mcp-server-builder) from ClawHub.
Skill page: https://clawhub.ai/sky-lv/skylv-mcp-server-builder
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install skylv-mcp-server-builder

ClawHub CLI

Package manager switcher

npx clawhub@latest install skylv-mcp-server-builder
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (MCP server builder) matches the content: the SKILL.md scaffolds an MCP server, tools, and resources. However, the example toolset includes powerful capabilities (file read/write/delete, database queries) that expand scope beyond a minimal 'scaffolding' helper; those capabilities are plausible for a server builder but should be explicitly justified and surfaced in requirements.
!
Instruction Scope
The runtime instructions show example handlers that perform arbitrary filesystem operations and database access. Because SKILL.md is an instruction-only skill, it currently guides building a server that—if run—would allow models to read/write/list/delete arbitrary paths and run SQL. The document does not provide security controls, access restrictions, or guidance to limit these operations, which grants broad discretion and high risk if followed verbatim.
Install Mechanism
Instruction-only skill with no install spec and no code files executed by the platform. This minimizes immediate install-time risk (nothing is downloaded or executed by the platform).
!
Credentials
skill.json and SKILL.md declare no required env vars, yet the DB tool comments refer to process.env.DATABASE_URL and the examples implicitly require runtime access to the filesystem and any DB credentials. The absence of declared credentials or config expectations is under-specified and disproportionate to the sensitive capabilities shown.
Persistence & Privilege
No 'always: true' flag, no install steps, and no indication the skill modifies other skills or system-wide settings. Autonomous invocation is permitted (platform default) but not combined with other privilege escalations in the package metadata.
What to consider before installing
This skill is a tutorial/scaffold for building an MCP server and includes example tools that can read/write arbitrary files and run database queries. That makes it potentially dangerous if you run the generated server without safeguards. Before using: review and harden any generated code (remove or restrict file_operations and database_query handlers), require explicit authentication/authorization for tool calls, avoid running on hosts containing sensitive data or as root, provide and document needed environment variables (e.g., DATABASE_URL) rather than leaving them implicit, and restrict tool input validation and allowed paths. Because the package is instruction-only (no install), the immediate platform risk is low—but follow the cautions above before building or deploying any server produced from these instructions.

Like a lobster shell, security has layers — review code before you run it.

latestvk973eg76vnp2njzd7yyjs164vd856qkk
146downloads
0stars
4versions
Updated 1w ago
v1.0.3
MIT-0

MCP Server Builder

功能说明

构建 Model Context Protocol 服务器,扩展 AI 能力边界。

MCP 协议概述

MCP 是 Anthropic 推出的 AI 模型上下文协议,让 AI 能调用外部工具和数据源。

项目结构

mcp-server/
├── package.json
├── tsconfig.json
├── src/
│   ├── index.ts          # 主入口
│   ├── tools/            # 工具定义
│   └── resources/         # 资源定义
└── tsconfig.json

完整实现

1. 初始化项目

npm init -y
npm install @modelcontextprotocol/sdk zod
npm install -D typescript @types/node ts-node
// package.json
{
  "name": "my-mcp-server",
  "version": "1.0.0",
  "type": "module",
  "scripts": {
    "build": "tsc",
    "start": "node dist/index.js",
    "dev": "ts-node src/index.ts"
  },
  "dependencies": {
    "@modelcontextprotocol/sdk": "^0.5.0",
    "zod": "^3.22.0"
  }
}
// tsconfig.json
{
  "compilerOptions": {
    "target": "ES2022",
    "module": "NodeNext",
    "moduleResolution": "NodeNext",
    "outDir": "./dist",
    "rootDir": "./src",
    "strict": true,
    "esModuleInterop": true
  },
  "include": ["src/**/*"]
}

2. 定义工具

// src/tools/search.ts
import { z } from 'zod';

export const searchTool = {
  name: 'web_search',
  description: '搜索互联网获取最新信息',
  inputSchema: z.object({
    query: z.string().describe('搜索关键词'),
    limit: z.number().optional().default(5).describe('返回结果数量')
  }),

  async handler(args: { query: string; limit?: number }) {
    // 实际实现
    const results = await performSearch(args.query, args.limit || 5);
    return {
      content: results.map(r => ({
        type: 'text' as const,
        text: `标题: ${r.title}\n链接: ${r.url}\n摘要: ${r.snippet}`
      }))
    };
  }
};

3. 定义资源

// src/resources/knowledge.ts
export const knowledgeResources = {
  uriPrefix: 'knowledge://',

  list: async () => [
    {
      uri: 'knowledge://docs/latest',
      name: '最新文档',
      description: '系统最新文档版本',
      mimeType: 'text/markdown'
    }
  ],

  read: async (uri: string) => {
    if (uri === 'knowledge://docs/latest') {
      return {
        contents: [{
          uri,
          mimeType: 'text/markdown',
          text: '# 最新文档\n\n...'
        }]
      };
    }
    throw new Error('Resource not found');
  }
};

4. 主入口

// src/index.ts
import { Server } from '@modelcontextprotocol/sdk/server/index.js';
import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
import {
  CallToolRequestSchema,
  ListToolsRequestSchema,
  ListResourcesRequestSchema,
  ReadResourceRequestSchema
} from '@modelcontextprotocol/sdk/types.js';

import { searchTool } from './tools/search.js';
import { knowledgeResources } from './resources/knowledge.js';

class MyMCPServer {
  private server: Server;

  constructor() {
    this.server = new Server(
      { name: 'my-mcp-server', version: '1.0.0' },
      { capabilities: { tools: {}, resources: {} } }
    );

    this.setupToolHandlers();
    this.setupResourceHandlers();
  }

  private setupToolHandlers() {
    this.server.setRequestHandler(ListToolsRequestSchema, async () => ({
      tools: [
        {
          name: searchTool.name,
          description: searchTool.description,
          inputSchema: searchTool.inputSchema
        }
      ]
    }));

    this.server.setRequestHandler(CallToolRequestSchema, async (request) => {
      const { name, arguments: args } = request.params;
      
      if (name === 'web_search') {
        return await searchTool.handler(args as any);
      }
      
      throw new Error(`Unknown tool: ${name}`);
    });
  }

  private setupResourceHandlers() {
    this.server.setRequestHandler(ListResourcesRequestSchema, async () => ({
      resources: await knowledgeResources.list()
    }));

    this.server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
      return await knowledgeResources.read(request.params.uri);
    });
  }

  async start() {
    const transport = new StdioServerTransport();
    await this.server.connect(transport);
    console.error('MCP Server started on stdio');
  }
}

new MyMCPServer().start().catch(console.error);

5. 更多工具示例

// 文件操作工具
export const fileTools = {
  name: 'file_operations',
  description: '读取、写入、列出文件',
  inputSchema: z.object({
    operation: z.enum(['read', 'write', 'list', 'delete']),
    path: z.string(),
    content: z.string().optional()
  }),

  async handler(args: any) {
    const fs = await import('fs/promises');
    
    switch (args.operation) {
      case 'read': {
        const content = await fs.readFile(args.path, 'utf-8');
        return { content: [{ type: 'text', text: content }] };
      }
      case 'write': {
        await fs.writeFile(args.path, args.content || '');
        return { content: [{ type: 'text', text: 'File written successfully' }] };
      }
      case 'list': {
        const files = await fs.readdir(args.path);
        return { content: [{ type: 'text', text: files.join('\n') }] };
      }
      default:
        throw new Error(`Unknown operation: ${args.operation}`);
    }
  }
};

// 数据库查询工具
export const dbTool = {
  name: 'database_query',
  description: '执行数据库查询',
  inputSchema: z.object({
    sql: z.string().describe('SQL查询语句'),
    params: z.array(z.any()).optional()
  }),

  async handler(args: any) {
    // 使用 mysql2 或 pg
    // const pool = new Pool({ connectionString: process.env.DATABASE_URL });
    // const result = await pool.query(args.sql, args.params);
    return {
      content: [{ type: 'text', text: JSON.stringify({ rows: [], count: 0 }) }]
    };
  }
};

测试

# 编译
npm run build

# 手动测试
echo '{"jsonrpc":"2.0","method":"tools/list","id":1}' | npm run dev

# MCP Inspector
npx @modelcontextprotocol/inspector npm run dev

部署

Claude Desktop

// ~/.config/claude-desktop/claude_desktop_config.json
{
  "mcpServers": {
    "my-mcp-server": {
      "command": "node",
      "args": ["/path/to/mcp-server/dist/index.js"],
      "env": {
        "API_KEY": "your-api-key"
      }
    }
  }
}

Cursor / VS Code

在扩展设置中添加 MCP 服务器路径。

最佳实践

  1. 错误处理:始终返回有意义的错误信息
  2. 类型安全:使用 Zod 严格验证输入
  3. 日志记录:使用 console.error 记录关键事件
  4. 性能:长时间操作使用流式响应
  5. 安全:不记录敏感信息,定期清理日志

Usage

  1. Install the skill
  2. Configure as needed
  3. Run with OpenClaw

Comments

Loading comments...