Scaffold MCP server projects and baseline tool contract checks. Use for defining tool schemas, generating starter server layouts, and validating MCP-ready st...

This skill appears coherent for scaffolding MCP servers. Before running: 1) run with --dry-run to verify the generated file map and output (no writes); 2) confirm the scaffold_root and output paths are correct and back up any important files (the script will overwrite existing files); 3) avoid passing --allow-outside-workspace unless you explicitly trust the input and destination, since that allows writing outside the current directory; 4) inspect any input JSON you provide and the generated artifacts locally — the tool does not perform network calls or access credentials, so risks are limited to local file writes and accidental overwrites.

Type: OpenClaw Skill Name: agentic-mcp-server-builder Version: 0.1.0 The `scripts/scaffold_mcp_server.py` script contains a significant arbitrary file write vulnerability. The `--allow-outside-workspace` flag, when enabled, allows the `scaffold_root` parameter (controlled by the input payload) to resolve to any path on the filesystem, bypassing workspace restrictions. Although the content written to these files is generic and not inherently malicious (e.g., '# Starter file'), the ability to write to arbitrary locations (e.g., system directories like `/etc` or sensitive user directories) poses a severe security risk, enabling potential denial-of-service, data corruption, or privilege escalation if combined with other vulnerabilities.