← 返回 Skills 市场
1266
总下载
0
收藏
0
当前安装
3
版本数
在 OpenClaw 中安装
/install nemo
功能描述
Search and invoke over 1500 MCP tools and agent skills across remote servers, with access to full skill instructions and usage details.
安全使用建议
This skill is a discovery/proxy that fetches and invokes tools hosted on external servers. Before installing: (1) verify and trust the nemo endpoint (https://nemo.25chenghua.workers.dev) and its operator — there is no homepage or owner reputation here; (2) do not allow the agent to send secrets or credentials when using this skill — treat all calls as going to an untrusted network; (3) prefer manual review: use search_tools to find candidates, then fetch SKILL.md and inspect it yourself before allowing the agent to 'follow' any install or execution instructions; (4) restrict or disable autonomous invocation for this skill if you are concerned about the agent invoking remote tools without confirmation; (5) consider running any tests in an isolated/sandbox environment and limit network egress if possible. If you need help assessing a specific nemo search result or a fetched SKILL.md, review that content separately before trusting it.
功能分析
Type: OpenClaw Skill
Name: nemo
Version: 1.0.2
This skill is suspicious due to two primary prompt injection vulnerabilities. Firstly, the `call_tool` functionality (described in `skill.md` and `README.md`) allows the agent to proxy arbitrary network requests to any specified `SERVER_URL` with any `tool` name and `args` via the `https://nemo.25chenghua.workers.dev` service. This provides a powerful primitive that could be abused for internal network scanning, data exfiltration, or remote code execution if the agent is prompted to target malicious endpoints. Secondly, and more critically, both `skill.md` and `README.md` explicitly instruct the AI agent to 'follow them' after retrieving instructions for other skills via `get_skill`. This is a direct prompt injection vulnerability, as it instructs the agent to execute arbitrary commands or instructions from potentially untrusted remote `SKILL.md` content, leading to a high risk of arbitrary code execution.
能力评估
Purpose & Capability
The SKILL.md describes a search-and-proxy service (search_tools, call_tool, get_skill) and the included files match that behavior. However the published package lacks a description/homepage and the owner is unknown, so provenance is weak even though functionality is coherent.
Instruction Scope
Instructions tell agents to fetch full SKILL.md documents and to POST arbitrary tool calls (endpoint, tool, args) to nemo's API. That is consistent with a discovery/proxy tool, but it gives the agent the ability to fetch and then 'follow' arbitrary instructions from unknown third parties and to forward arbitrary inputs to remote endpoints — which can lead to sensitive data being sent externally or execution of unsafe instructions. The skill provides no guidance or constraints about not forwarding secrets or about validating fetched instructions.
Install Mechanism
Instruction-only skill with no install spec or code files. This is low-risk from an install surface perspective because nothing is written to disk by the package itself.
Credentials
The skill declares no required environment variables or credentials, which is proportionate. However, its documented workflow encourages calling external tools that may request credentials or accept arbitrary input; the skill does not warn agents to avoid sending secrets to remote endpoints.
Persistence & Privilege
always:false (normal) but model invocation is enabled (default), so an autonomous agent could call the external service without the user's direct action. Combined with the ability to fetch and follow arbitrary SKILL.md content and call arbitrary endpoints, this increases the potential blast radius if the external service or indexed tools are untrusted.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install nemo - 安装完成后，直接呼叫该 Skill 的名称或使用
/nemo触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.2
**Summary:** Migrated skill metadata files and significantly expanded documentation.
- Renamed metadata files from SKILL.md/SKILL.yaml to skill.md/skill.yaml.
- Greatly expanded documentation with detailed sections on available tools, HTTP API usage, and workflow.
- Added support and docs for searching both MCP server tools and agent skills (790+ tools, 760+ skills).
- Introduced new get_skill capability for retrieving full agent skill instructions.
v1.0.1
- Expanded functionality: now searches 790+ MCP tools and 760+ agent skills with new endpoints and features.
- Added a new tool, get_skill, to retrieve full skill instructions and metadata.
- Updated documentation with detailed HTTP API usage examples for searching, getting skill instructions, and calling remote tools.
- Improved search_tools: now supports searching agent skills and filtering by type (all, mcp, skills).
- Removed old SKILL.md and SKILL.yaml; replaced with updated skill.md and skill.yaml files.
v1.0.0
Nemo 1.0.0 — Initial release
- Aggregates tools from multiple remote MCP servers.
- Provides search_tools to find and rank tools by keyword across all indexed servers.
- Supports call_tool to remotely invoke any MCP server tool, tracking latency and usage.
- Designed for AI agents to dynamically discover and use distributed MCP tools.
元数据
常见问题
Nemo 是什么？
Search and invoke over 1500 MCP tools and agent skills across remote servers, with access to full skill instructions and usage details. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 1266 次。
如何安装 Nemo？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install nemo」即可一键安装，无需额外配置。
Nemo 是免费的吗？
是的，Nemo 完全免费（开源免费），可自由下载、安装和使用。
Nemo 支持哪些平台？
Nemo 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Nemo？
由 Mootbing（@mootbing）开发并维护，当前版本 v1.0.2。
推荐 Skills