← Back to Skills Marketplace
236
Downloads
1
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install mcp-to-skill
Description
Converts any MCP server into a standalone skill package with zero runtime dependencies (no MCP process required). Trigger when user says: "convert this MCP t...
Usage Guidance
This skill performs network downloads, extracts npm packages, and runs a user-supplied MCP start command — which will execute arbitrary code. Before installing or running it: (1) do not run it with sensitive credentials present; remove or rotate tokens you don't want exposed; (2) prefer providing a schema JSON instead of a start command so no remote package is executed; (3) run mcp_inspector and the skill generation in an isolated environment (container/VM) and inspect the extracted package and generated SKILL.md/secrets.json before registering; (4) expect the skill to call pip/npm/tar at runtime — if you require an explicit install policy or denylist, ask the author to declare required binaries and to avoid auto-downloading packages. These mismatches (no declared binaries/env but runtime downloads and execution) are why I rate the package suspicious.
Capability Analysis
Type: OpenClaw Skill
Name: mcp-to-skill
Version: 1.0.0
The skill automates the conversion of MCP servers into standalone skills by downloading source code via 'npm pack', extracting it, and using an AI agent to infer and execute shell commands. Key risks include the automated execution of AI-inferred 'read-only' commands (Step 4 in SKILL.md) and the modification of the agent's environment by symlinking new skills into ~/.claude/skills (Step 6). While these actions align with the tool's stated purpose, they provide a mechanism for potential remote code execution and persistence if the input MCP server or the AI's inferences are untrusted.
Capability Assessment
Purpose & Capability
The skill claims to convert an MCP server to a skill without runtime dependencies, but the SKILL.md and mcp_inspector.py require runtime tools: Python, pip, the 'mcp' Python package, npm, tar and ability to start the provided MCP command. Registry metadata lists no required binaries/env vars, which is inconsistent with what the skill actually needs to do.
Instruction Scope
Instructions tell the agent to: run the user-supplied MCP start command (which spawns arbitrary code), run mcp_inspector.py, download and extract npm packages, read/write temp files (/tmp/...), read source code (when available), and execute inferred read-only HTTP/CLI commands for verification. These actions are within the stated conversion purpose but give the skill broad discretion to execute user-provided commands and contact external networks; that expands scope beyond a simple static analysis tool.
Install Mechanism
There is no formal install spec, but runtime steps include 'pip install mcp' and mcp_inspector.py calls 'npm pack' and 'tar' to download and extract packages into /tmp. Downloading, extracting, and interacting with npm packages from arbitrary package names is higher risk and is not declared in the registry metadata.
Credentials
The skill declares no required env vars or credentials, yet SKILL.md instructs reading secrets.json and environment variables (e.g., X_API_TOKEN) for generated skills, and mcp_inspector will create files under /tmp and a cache dir. The skill may therefore access local secrets or tokens implicitly even though none are declared.
Persistence & Privilege
always is false and the skill does not request forced/system-wide persistence. The SKILL.md instructs registering the generated skill with the agent (expected for its purpose). Autonomous invocation (model invocation enabled) is default but not by itself a new risk here.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install mcp-to-skill - After installation, invoke the skill by name or use
/mcp-to-skill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
mcp-to-skill v1.0.0
- Introduces a tool for converting any MCP server into a standalone skill package with zero runtime dependencies.
- Guides users through extracting tool schemas, analyzing code or documentation, and generating a ready-to-use skill—no MCP process required.
- Provides configurable language support for generated files.
- Ensures secrets safety by separating public config and sensitive credentials.
- Supports auto-registration with popular AI agent frameworks, with fallback to manual instructions.
- Optionally prompts users to remove the original MCP configuration after conversion.
Metadata
Frequently Asked Questions
What is mcp-to-skill?
Converts any MCP server into a standalone skill package with zero runtime dependencies (no MCP process required). Trigger when user says: "convert this MCP t... It is an AI Agent Skill for Claude Code / OpenClaw, with 236 downloads so far.
How do I install mcp-to-skill?
Run "/install mcp-to-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is mcp-to-skill free?
Yes, mcp-to-skill is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does mcp-to-skill support?
mcp-to-skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created mcp-to-skill?
It is built and maintained by JalanChao (@jalanchao); the current version is v1.0.0.
More Skills