Deal Works Mcp

• Analyzed: May 11, 2026, 4:50 AM
• Findings: 1
• Version: 0.1.0
• Hash: 6494491ead9d2f69ee3c88b7955da7facfcd182ed2c048a38ddae3b3a8f73ff3
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle for 'deal-works-mcp' appears benign. The code (dist/index.js, src/*) consistently makes API calls only to explicitly defined `*.works` domains, aligning with the security claims in SKILL.md and README.md. Input validation is robustly implemented using `zod` schemas for all tool arguments, mitigating common injection vulnerabilities. The SKILL.md and src/prompts.ts files contain instructions for the AI agent that are clearly aligned with the stated purpose of managing deals, escrow, and agents, without any evidence of prompt injection attempts to exfiltrate data, establish persistence, or perform unauthorized actions. While financial transaction tools like `fund_cashout` exist, they are part of the skill's stated purpose and are not used maliciously within the skill's own logic.