N2 Stitch MCP

Resilient MCP proxy for Google Stitch — 3-layer safety (auto-retry, token refresh, TCP drop recovery).

This skill appears to be what it says (a Stitch MCP proxy) but the instructions rely on downloading and running an npm package via npx and on Google ADC/API keys that are not declared in the registry metadata. Before installing or invoking it: - Inspect the npm package and the GitHub repo (https://github.com/choihyunsus/n2-stitch-mcp) to verify the code matches the described behavior and contains no unexpected network/credential exfiltration. - Avoid using broad Google ADC with high-privilege accounts; prefer a minimal-scope service account or a Stitch-only API key limited to necessary operations. - Consider pinning the package to a specific, audited version rather than using unfrozen npx pulls. - Run the MCP proxy in an isolated environment (container or sandbox) until you have audited it. - If possible, ask the publisher to include an install spec or the code in the bundle so it can be statically reviewed rather than relying on runtime npx fetch. Because of the mismatch between metadata and runtime instructions and the runtime fetching of code, treat this skill with caution unless you can audit the external package and credential scopes first.

Type: OpenClaw Skill Name: n2-stitch-mcp Version: 1.0.0 The `SKILL.md` file instructs the OpenClaw agent to execute an external npm package via `npx -y n2-stitch-mcp`. This command fetches and runs code from the npm registry, introducing a significant supply chain risk and a potential remote code execution vulnerability if the external package were compromised or malicious. While the stated purpose is to provide a resilient proxy, the method of execution involves running arbitrary external code, which is a high-risk behavior.