Openclaw
v0.3.0Query Nile Markets — on-chain FX markets powered by the Open Nile Protocol, starting with non-deliverable forwards (NDFs). Read-only MCP integration for pool...
⭐ 0· 65·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the files and instructions: this is a read-only MCP integration for Nile Markets on Sepolia. The only mismatch is metadata at the top of the report claiming "Required env vars: none" while SKILL.md and config/mcporter.json require NILE_MCP_URL. Aside from that reporting inconsistency, the requested access (an MCP endpoint URL) is appropriate for the stated purpose.
Instruction Scope
SKILL.md explicitly documents only read-only queries to the MCP server and instructs agents to refuse any wallet/transaction actions. It references only the MCP endpoint and no unrelated files, system paths, or secrets.
Install Mechanism
No install spec or code is included (instruction-only). This minimizes filesystem/write risk; the skill relies on a pre-existing MCP client/transport provided by the platform.
Credentials
The skill requires a single environment value (NILE_MCP_URL) to point to the MCP server — proportionate to its function. Note the registry summary incorrectly listed no required env vars; verify the platform will surface and validate NILE_MCP_URL at install/runtime. There are no credential-like env vars (no keys/tokens/passwords) requested.
Persistence & Privilege
always is false and the skill does not request elevated or persistent system privileges. Autonomous invocation is allowed (platform default) but that is expected for an agent skill and not problematic here given the limited read-only scope.
Assessment
This appears to be a straightforward read-only skill. Before installing: 1) Confirm the NILE_MCP_URL you set points to the official Nile Markets MCP server (e.g., https://mcp.nilemarkets.com/api/mcp) and uses HTTPS/TLS; do not set it to an untrusted host. 2) Note the registry summary omitted the required NILE_MCP_URL—expect to supply that env var at runtime. 3) Because this is an instruction-only skill with no code, risks are limited to the MCP endpoint you point it at; avoid pointing the URL to unknown or personal servers which could return unexpected data. 4) If you need stronger assurance, ask the publisher for a homepage or source repo and verify the MCP server's documentation and TLS certificate before use.Like a lobster shell, security has layers — review code before you run it.
latestvk97aksppg3w04q73yyb37a54th840xp1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.