mcp-sanctions-check

Check names against the OFAC SDN (Specially Designated Nationals) sanctions list via MCP. Downloads and caches official SDN CSV, auto-refreshes every 24h. Ca...

This skill appears coherent and implements an OFAC SDN name-checker that downloads the official CSV and caches it locally. Before installing or running it: 1) confirm the npm package name and publisher you will fetch with npx (SKILL.md uses @vbotholemu/mcp-sanctions-check, README references @velocibot — verify which is correct on npm and who the publisher is); 2) be aware npx will download and execute code from the npm registry at runtime — run in an isolated environment if you cannot verify the package; 3) the tool caches data in the OS temp directory (ofac-sdn-cache.csv) and refreshes every 24h; if you need to override the source CSV you can set SDN_URL (undocumented in SKILL.md); and 4) review the package on the npm registry (publisher, versions, recent changes) or inspect the included source before trusting it in production.

Type: OpenClaw Skill Name: mcp-sanctions-check Version: 1.0.0 The skill provides a legitimate utility for screening names against the official US Treasury OFAC SDN sanctions list. The code (src/index.ts) downloads the official CSV from treasury.gov, caches it in the system's temporary directory, and performs local token-based matching. There is no evidence of data exfiltration, unauthorized network calls, or malicious execution logic.