skill-feedback-collector

Human-in-the-loop MCP feedback collector with task queue. Pauses to collect human input via browser UI before continuing. Use when completing tasks, encounte...

This skill appears to do what it says: run a local MCP server that pauses the agent and asks for human feedback via a browser UI. Before installing or deploying, consider: 1) Run it in a network-isolated environment (or bind to localhost) if you don't want external access. By default the server/CORS allow public access and FEEDBACK_TOKEN is empty — set FEEDBACK_TOKEN and/or use a firewall to restrict access. 2) Conversation history is saved locally (feedback-history.json) — treat it as sensitive and rotate or delete as needed. 3) Auto-mode (autoMode) can auto-dequeue tasks and let the agent continue without manual confirmation — be aware if you rely on strict human approval. 4) The package is installed from npm; review the published package/source and confirm the package owner/trust before running in production. 5) If you have low tolerance for risk, run the skill in a sandboxed container or on a private host and review src/index.ts (provided) and any transitive dependencies before enabling in a public-facing environment.

Type: OpenClaw Skill Name: skill-feedback-collector Version: 1.0.2 The skill bundle implements a legitimate human-in-the-loop feedback mechanism using a Model Context Protocol (MCP) server and a WebSocket-based UI. The core logic in `src/index.ts` allows an AI agent to pause execution and wait for human input or process a pre-loaded task queue, which is the stated purpose in `SKILL.md`. The implementation includes standard features for such a tool, including local history persistence (`feedback-history.json`), optional token-based authentication (`FEEDBACK_TOKEN`), and a fallback to HTTP long-polling. No evidence of malicious intent, data exfiltration, or unauthorized command execution was found.