Skills Indec MCP

Search, score, and submit 11,000+ AI agent tools from SkillsIndex, filtered by ecosystem, category, and rated on security, utility, and maintenance.

This skill appears to do what it says (search and submit to SkillsIndex), but it runs an npm package via `npx`, which will fetch and execute code from the npm registry at runtime. Because that code could potentially access files or environment variables, do not assume the 'no local file access' claim is guaranteed unless you verify the package. Before installing or invoking: 1) review the npm package page and the linked GitHub repository (confirm package version and that published code matches the repo), 2) consider pinning to a specific package version instead of running the latest, 3) run the package in a sandboxed environment the first time, 4) avoid submitting any secrets or sensitive data through submit_tool/subscribe endpoints, and 5) if you need a higher assurance, vendor the package (audit the code) or request the skill bundle include the compiled code so it can be statically reviewed. If you want higher assurance, provide the skill's npm package version and the GitHub commit/tarball hashes so an integrity check can be performed.

Type: OpenClaw Skill Name: skillsindex-mcp Version: 1.0.1 The skill is transparent about its operations, explicitly stating that it uses `npx skillsindex-mcp` to run, which involves downloading a package from `npmjs.com` and making network calls to `skillsindex.dev`. The `SKILL.md` documentation clearly outlines all network endpoints, claims no local file access or data exfiltration, and provides links to open-source code. There is no evidence of prompt injection attempts against the AI agent, hidden malicious commands, or unauthorized data access/exfiltration. The use of `npx` is a standard method for running Node.js-based skills and is openly declared, not hidden or used for malicious purposes, aligning with the stated functionality.