← Back to Skills Marketplace
ProofTrail MCP Skill
by
Yifeng[Terry] Yu
· GitHub ↗
· v0.1.1
· MIT-0
113
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install prooftrail-mcp
Description
Teach an agent to install ProofTrail's governed stdio MCP server, use the safest read and proof tools first, and keep future package or listing claims honest.
Usage Guidance
This packet is internally consistent and appears to do what it claims: guide you to attach a repo-local ProofTrail stdio MCP server and prefer read/proof tools first. Before running anything: (1) inspect the GitHub repo (https://github.com/xiaojiou176-open/prooftrail.git) and review package.json scripts and pnpm install effects; (2) substitute the correct local cwd path in the provided config snippets; (3) only set UIQ_MCP_API_BASE_URL and any token env vars if you trust the backend and need live reads; (4) treat 'publish-ready' npm/Docker names as unpublished until you verify they exist. The skill contains no declared secrets or hidden endpoints, but cloning and running a third‑party repo can execute arbitrary code—review the repo before use.
Capability Analysis
Type: OpenClaw Skill
Name: prooftrail-mcp
Version: 0.1.1
The skill bundle instructs the AI agent to perform high-risk supply chain operations, specifically cloning a remote GitHub repository (github.com/xiaojiou176-open/prooftrail.git) and executing 'pnpm install' and 'pnpm mcp:start' (as detailed in references/INSTALL.md). While these actions are consistent with the stated purpose of setting up a local MCP server, they create a significant risk of Remote Code Execution (RCE) through untrusted third-party code or malicious npm lifecycle scripts, lacking any verification or sandboxing mechanisms.
Capability Tags
Capability Assessment
Purpose & Capability
The name and description (install and use a repo-local ProofTrail stdio MCP server and prefer read/proof tools first) match the instructions and included reference files. The manifest, CAPABILITIES.md, and demo all align with that stated purpose. Nothing in the package asks for unrelated capabilities.
Instruction Scope
SKILL.md and the reference docs focus on cloning the ProofTrail repo, running pnpm commands, attaching a repo-local stdio MCP server, and using safe-first tooling. The instructions do not ask the agent to read arbitrary host files, exfiltrate data, or contact unknown endpoints; they only note optional backend reads (UIQ_MCP_API_BASE_URL and 'any required token env vars') when live backend access is explicitly needed.
Install Mechanism
This is an instruction-only skill (no install spec or code included). The recommended install is to git clone https://github.com/xiaojiou176-open/prooftrail.git and run pnpm install / pnpm mcp:start. That is coherent with the purpose, but cloning and running a third-party repo executes code from an external source—normal for this use case but a security consideration the user must evaluate separately.
Credentials
The package declares no required env vars or credentials. The docs responsibly call out that if a real backend is needed the operator may set UIQ_MCP_API_BASE_URL and any backend token env vars; those are optional and consistent with the documented 'local-with-optional-backend-token' auth.
Persistence & Privilege
always is false and there is no install-time code or hooks that would modify other skills or system-wide settings. The skill is an instruction packet only and does not request elevated persistence or privileges.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install prooftrail-mcp - After installation, invoke the skill by name or use
/prooftrail-mcp - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.1
ProofTrail MCP Skill v0.1.1
- Adds clear step-by-step instructions for installing and connecting the ProofTrail governed MCP server from a local repo.
- Emphasizes a safe-first workflow: start with catalog and read tools before running broader automation or proofs.
- Distinguishes between current repo-native usage and unlaunched package/Docker distribution; notes future publication plans without overclaiming.
- Lists strong boundaries: this is not a hosted service or store listing, and doesn't provide generic browser bot automation.
- Provides condensed guides and references to onboard new users safely and honestly.
Metadata
Frequently Asked Questions
What is ProofTrail MCP Skill?
Teach an agent to install ProofTrail's governed stdio MCP server, use the safest read and proof tools first, and keep future package or listing claims honest. It is an AI Agent Skill for Claude Code / OpenClaw, with 113 downloads so far.
How do I install ProofTrail MCP Skill?
Run "/install prooftrail-mcp" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is ProofTrail MCP Skill free?
Yes, ProofTrail MCP Skill is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does ProofTrail MCP Skill support?
ProofTrail MCP Skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created ProofTrail MCP Skill?
It is built and maintained by Yifeng[Terry] Yu (@xiaojiou176); the current version is v0.1.1.
More Skills