minecraft-bridge

Local HTTP bridge for Mineflayer-based live control of a Minecraft Java bot. Trigger when the user wants to connect a bot to their world, check bot status/in...

This skill appears to implement what it claims (a local Mineflayer HTTP bridge) but check a few things before installing or running it: 1) Verify the bridge binds only to localhost (127.0.0.1). If bridge-server.js calls server.listen(port) without a host, it may be reachable from the network — change it to server.listen(port, '127.0.0.1') or firewall it. 2) Confirm the environment-variables list: set MC_BRIDGE_PORT, MC_VERSION, and MC_AUTH as needed (these are referenced by the code/docs but not listed in metadata). 3) Be cautious with POST /command: it forwards arbitrary slash commands; do not run this against servers where the bot has operator privileges unless you trust commands being issued. 4) start.sh will run npm install locally; review the installed package versions and consider locking them (package-lock) or auditing packages before use. 5) Run the bridge under an unprivileged user, and avoid exposing the machine's network interface to untrusted networks. If you want me to, I can inspect the remainder of bridge-server.js (the truncated part) to confirm the server.listen call and any additional network or file operations.

Type: OpenClaw Skill Name: minecraft-bridge Version: 1.0.0 The bundle provides a legitimate local HTTP bridge for controlling a Mineflayer-based Minecraft bot. The code in `bridge-server.js` is well-structured, binding the API strictly to 127.0.0.1 and implementing a `BLOCKED_COMMANDS` regex to prevent the bot from being used for administrative abuse (e.g., /op, /ban). While the `/command` endpoint allows arbitrary in-game commands, the documentation in `SKILL.md` and `references/api-spec.md` explicitly warns about this risk, and there is no evidence of host-level execution, data exfiltration, or malicious prompt injection.