Prooflane MCP Skill

Clone, install, configure, and run Prooflane's repo-native MCP server locally for evaluation and verification without published package registry dependencies.

This packet is coherent for its stated purpose, but before you run anything: (1) inspect the upstream repository and the contents of ./scripts/setup.sh and any pnpm scripts referenced (pnpm mcp:start, mcp:check, etc.) to check for unexpected network calls, remote downloads, or privileged operations; (2) prefer cloning a specific commit/tag (pin the repo) rather than the default branch; (3) run the setup and server inside an isolated environment (VM or disposable container) and not on production hosts; (4) avoid supplying any sensitive credentials or tokens unless you audited how they are used; (5) if you need higher assurance, ask the publisher to provide a signed release, a verified organization repository, or a published package on a trusted registry so you can avoid running unreviewed repository scripts. If you can provide the contents of the repo (or the specific scripts referenced), I can re-evaluate with higher confidence.

Type: OpenClaw Skill Name: prooflane-mcp Version: 0.1.0 The skill bundle (SKILL.md, manifest.yaml, references/INSTALL.md) instructs the AI agent to clone an external GitHub repository (github.com/xiaojiou176-open/ui-automation-control-plane) and execute a setup script (./scripts/setup.sh). This pattern introduces a high risk of Remote Code Execution (RCE) as it requires the agent to run unvetted code from a third-party source. While the instructions are aligned with the stated goal of setting up the Prooflane MCP server, the requirement for broad execution permissions and the opaque nature of the external setup script make the bundle suspicious.