MCP Colombia

MCP Colombia Hub — aggregates Colombian services via MCP protocol. Soulprint identity verification integrated — verify Colombian users before sensitive opera...

This skill is plausible for aggregating Colombian services, but take precautions before installing: 1) Inspect the npm package source and the linked GitHub repo — npx will fetch and run code from the public registry. 2) Expect network calls to third-party services (Booking.com scraping, Brave Search, Awin affiliates, and a Soulprint validator hosted on railway.app). 3) The SKILL.md references BRAVE_API_KEY and affiliate tokens but the skill metadata doesn't declare them — ask the author which env vars/keys are needed and why. 4) If you plan to use job-application features, be aware the skill may transmit your CV/LinkedIn URL to external sites; avoid providing sensitive personal data until you've reviewed the implementation. 5) Prefer running the package in an isolated environment (sandbox or VM) and lock to a reviewed package version. If the author cannot explain the version mismatch and undeclared keys, treat the skill with suspicion.

Type: OpenClaw Skill Name: mcp-colombia Version: 1.0.9 The skill is classified as suspicious primarily due to its reliance on an external npm package (`mcp-colombia-hub`) executed via `npx -y`, which introduces a significant supply chain risk. If the npm package were compromised, it could lead to arbitrary code execution. Additionally, the `SKILL.md` explicitly states that 'Bot reputation is tracked automatically — good tool usage earns +1 attestations' within the Soulprint Integration, indicating telemetry and exfiltration of agent usage data to an external validator node (`https://soulprint-node-production.up.railway.app`). While framed as a feature, this constitutes data collection beyond direct user requests. The skill also requires access to the `BRAVE_API_KEY` environment variable and uses affiliate links, further highlighting external dependencies and potential data flows.