Wishfinity +W

Add "save for later" to shopping agents, product recommendation engines, gift idea generators, and AI commerce experiences. Saves any product URL to a universal wishlist. Requires MCP config and free Wishfinity account.

Security Scan

The skill's stated purpose (a wishlist/mcp helper) matches its instructions, but it tells the agent to run an unpinned npm package via npx (download-and-execute) with no install spec or provenance — a moderate-risk pattern that should be vetted before installing.

Purpose & Capability

Name/description match the runtime instructions: this is an MCP-based 'save for later' wishlist integration and it legitimately requires adding an MCP server entry (agents.list.0.mcp.servers) to run the connector.

Instruction Scope

SKILL.md only asks the agent to add an MCP server entry, call a single tool (add_to_wishlist with a URL), and present a link. It does not instruct reading unrelated files or exfiltrating data. However, it directs use of npx to fetch/run an external package at runtime (see install mechanism).

Install Mechanism

There is no formal install spec, but the SKILL.md instructs adding an MCP server whose command uses npx to run the npm package wishfinity-mcp-plusw. That causes code to be downloaded and executed from the npm registry at runtime (unpinned, no checksum). This is a moderate-to-high-risk delivery mechanism unless the package and repo are audited and a specific pinned/versioned install is provided.

Credentials

The skill declares no environment variables or secrets and only requires a single config path (agents.list.0.mcp.servers). That is proportionate for an MCP connector which needs to be registered in agent config.

Persistence & Privilege

always:false (normal). The setup requires editing ~/.openclaw/openclaw.json and restarting the gateway — this modifies agent configuration (expected), and once registered the MCP connector will be invoked by the agent which expands runtime attack surface because it executes external code when used.

What to consider before installing

This skill appears to do what it says, but it asks you to run an npm package via npx (wishfinity-mcp-plusw) by adding an MCP entry to your OpenClaw config. npx will fetch and execute code from the npm registry (unpinned) — that can run arbitrary code on your system. Before installing: 1) Verify the npm package name, maintainer, and popularity; review the GitHub repo (https://github.com/wishfinity/wishfinity-mcp-plusw) and the package source for malicious behavior; 2) Ask the author for a pinned version and checksum or a vetted install mechanism (GitHub release tarball or package with signature); 3) Consider running the connector in an isolated environment or sandbox; 4) Note you will be modifying ~/.openclaw/openclaw.json and restarting the gateway — ensure you trust the package and account flows on wishfinity.com. If you cannot audit the package or get a pinned release, treat this as risky and avoid installing.

Add a "save for later" action to your AI shopping experience. Works with product recommendation engines, gift idea generators, deal finders, and any agent that surfaces products.

Use cases:

• Shopping agents that recommend products
• Gift idea generators (save suggestions for later)
• Deal/price comparison bots
• Product research assistants
• Any AI commerce experience where users discover products

Requirements

• Free Wishfinity account at https://wishfinity.com
• MCP server configured (see Setup below)

Setup

Add the MCP server to your ~/.openclaw/openclaw.json:

{
  "agents": {
    "list": [{
      "id": "main",
      "mcp": {
        "servers": [{
          "name": "wishfinity",
          "command": "npx",
          "args": ["-y", "wishfinity-mcp-plusw"]
        }]
      }
    }]
  }
}

Restart your OpenClaw gateway after adding the config.

When to Use

Offer to save products when the user says things like:

• "Save this for later"
• "Add to my wishlist"
• "I want this"
• "Remember this product"
• "Bookmark this"

MCP Tool

add_to_wishlist

Input:

• url (string, required): Product page URL

Output:

• action_url: Link for user to click (opens Wishfinity)
• display_text: Suggested button text

The user clicks the returned link to complete the save. Authentication happens on Wishfinity's site — no API keys needed in your config.

Example

User: "That coffee maker looks great, save it for me"

Agent calls add_to_wishlist with the product URL, then presents the action link as a button.

Notes

• Works with any retailer (Amazon, Target, small shops, anywhere)
• Wishlists are shareable — useful for gifting
• Price tracking available in Wishfinity app
• This is a branded service (like Spotify), not a neutral utility

Links

• MCP server: https://github.com/wishfinity/wishfinity-mcp-plusw
• npm: wishfinity-mcp-plusw
• Wishfinity: https://wishfinity.com