← Back to Skills Marketplace
1266
Downloads
0
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install nemo
Description
Search and invoke over 1500 MCP tools and agent skills across remote servers, with access to full skill instructions and usage details.
Usage Guidance
This skill is a discovery/proxy that fetches and invokes tools hosted on external servers. Before installing: (1) verify and trust the nemo endpoint (https://nemo.25chenghua.workers.dev) and its operator — there is no homepage or owner reputation here; (2) do not allow the agent to send secrets or credentials when using this skill — treat all calls as going to an untrusted network; (3) prefer manual review: use search_tools to find candidates, then fetch SKILL.md and inspect it yourself before allowing the agent to 'follow' any install or execution instructions; (4) restrict or disable autonomous invocation for this skill if you are concerned about the agent invoking remote tools without confirmation; (5) consider running any tests in an isolated/sandbox environment and limit network egress if possible. If you need help assessing a specific nemo search result or a fetched SKILL.md, review that content separately before trusting it.
Capability Analysis
Type: OpenClaw Skill
Name: nemo
Version: 1.0.2
This skill is suspicious due to two primary prompt injection vulnerabilities. Firstly, the `call_tool` functionality (described in `skill.md` and `README.md`) allows the agent to proxy arbitrary network requests to any specified `SERVER_URL` with any `tool` name and `args` via the `https://nemo.25chenghua.workers.dev` service. This provides a powerful primitive that could be abused for internal network scanning, data exfiltration, or remote code execution if the agent is prompted to target malicious endpoints. Secondly, and more critically, both `skill.md` and `README.md` explicitly instruct the AI agent to 'follow them' after retrieving instructions for other skills via `get_skill`. This is a direct prompt injection vulnerability, as it instructs the agent to execute arbitrary commands or instructions from potentially untrusted remote `SKILL.md` content, leading to a high risk of arbitrary code execution.
Capability Assessment
Purpose & Capability
The SKILL.md describes a search-and-proxy service (search_tools, call_tool, get_skill) and the included files match that behavior. However the published package lacks a description/homepage and the owner is unknown, so provenance is weak even though functionality is coherent.
Instruction Scope
Instructions tell agents to fetch full SKILL.md documents and to POST arbitrary tool calls (endpoint, tool, args) to nemo's API. That is consistent with a discovery/proxy tool, but it gives the agent the ability to fetch and then 'follow' arbitrary instructions from unknown third parties and to forward arbitrary inputs to remote endpoints — which can lead to sensitive data being sent externally or execution of unsafe instructions. The skill provides no guidance or constraints about not forwarding secrets or about validating fetched instructions.
Install Mechanism
Instruction-only skill with no install spec or code files. This is low-risk from an install surface perspective because nothing is written to disk by the package itself.
Credentials
The skill declares no required environment variables or credentials, which is proportionate. However, its documented workflow encourages calling external tools that may request credentials or accept arbitrary input; the skill does not warn agents to avoid sending secrets to remote endpoints.
Persistence & Privilege
always:false (normal) but model invocation is enabled (default), so an autonomous agent could call the external service without the user's direct action. Combined with the ability to fetch and follow arbitrary SKILL.md content and call arbitrary endpoints, this increases the potential blast radius if the external service or indexed tools are untrusted.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install nemo - After installation, invoke the skill by name or use
/nemo - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
**Summary:** Migrated skill metadata files and significantly expanded documentation.
- Renamed metadata files from SKILL.md/SKILL.yaml to skill.md/skill.yaml.
- Greatly expanded documentation with detailed sections on available tools, HTTP API usage, and workflow.
- Added support and docs for searching both MCP server tools and agent skills (790+ tools, 760+ skills).
- Introduced new get_skill capability for retrieving full agent skill instructions.
v1.0.1
- Expanded functionality: now searches 790+ MCP tools and 760+ agent skills with new endpoints and features.
- Added a new tool, get_skill, to retrieve full skill instructions and metadata.
- Updated documentation with detailed HTTP API usage examples for searching, getting skill instructions, and calling remote tools.
- Improved search_tools: now supports searching agent skills and filtering by type (all, mcp, skills).
- Removed old SKILL.md and SKILL.yaml; replaced with updated skill.md and skill.yaml files.
v1.0.0
Nemo 1.0.0 — Initial release
- Aggregates tools from multiple remote MCP servers.
- Provides search_tools to find and rank tools by keyword across all indexed servers.
- Supports call_tool to remotely invoke any MCP server tool, tracking latency and usage.
- Designed for AI agents to dynamically discover and use distributed MCP tools.
Metadata
Frequently Asked Questions
What is Nemo?
Search and invoke over 1500 MCP tools and agent skills across remote servers, with access to full skill instructions and usage details. It is an AI Agent Skill for Claude Code / OpenClaw, with 1266 downloads so far.
How do I install Nemo?
Run "/install nemo" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Nemo free?
Yes, Nemo is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Nemo support?
Nemo is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Nemo?
It is built and maintained by Mootbing (@mootbing); the current version is v1.0.2.
More Skills