RentaUnHumano MCP

Hire Spanish-speaking humans for real-world tasks in Latin America. Create missions, browse humans, manage payments, reviews, and disputes through 15 MCP tools.

This skill appears to be what it says: an MCP adapter that needs mcporter and a RENTA_API_KEY. Before installing: (1) Treat RENTA_API_KEY like a sensitive credential — use a sandbox_ key for testing and rotate keys after use. (2) Inspect the @rentaunhumano/mcp-server npm package (and prefer a pinned version) because the mcporter config runs it via npx (runtime code download). (3) Ensure mcporter is from a trusted source and that adding config/mcporter.json is acceptable in your environment. (4) If you don't want the agent to autonomously create missions or trigger payments, restrict autonomous invocation or add explicit confirmation steps. (5) Verify the service (rentaunhumano.com) and its terms, and confirm payment flow and dispute controls before providing a production API key.

Type: OpenClaw Skill Name: rentaunhumano-mcp Version: 1.0.0 The skill is suspicious due to instructions in `SKILL.md` that pose a significant supply chain risk. Specifically, the setup guide instructs the agent to configure `mcporter` to run `npx -y @rentaunhumano/mcp-server`. The `npx -y` command downloads and executes an arbitrary npm package without user confirmation, which could lead to arbitrary code execution if the `@rentaunhumano/mcp-server` package were compromised or malicious. Additionally, the skill instructs the agent to make an external `curl` call to `https://rentaunhumano.com/api/agents/register` to register an account, involving interaction with an external service.