Scaffold MCP server projects and baseline tool contract checks. Use for defining tool schemas, generating starter server layouts, and validating MCP-ready st...

This skill appears to do only scaffolding and contract-summary generation and does not request secrets or network access. Before running: 1) prefer dry-run to inspect output without file writes; 2) avoid enabling --allow-outside-workspace unless you trust the payload and want files written outside the current directory; 3) review and validate any input JSON (it is capped at 1MB) and the generated artifact path to avoid overwriting important files; 4) note the metadata mismatches (ownerId/slug/version) — they suggest sloppy packaging but not necessarily malicious intent. If you plan to run this in an automated agent, test it interactively first in an isolated workspace.

Type: OpenClaw Skill Name: agentic-mcp-server-builder-conflict Version: 1.0.0 The skill contains a scaffolding script (`scripts/scaffold_mcp_server.py`) that allows writing files to arbitrary locations on the filesystem. Specifically, the `--output` argument is not validated against the workspace root, and the script includes an explicit `--allow-outside-workspace` flag that bypasses directory restrictions for the scaffolded files. While the intended use case is project generation, these capabilities represent a high-risk surface for an AI agent, as they could be exploited via prompt injection to overwrite sensitive configuration files (e.g., .bashrc, SSH keys) with the script's output.