Civic

Connect to Civic MCP for 100+ integrations.

This skill appears to do what it says: it connects an agent to a Civic MCP instance and either uses mcporter or runs the provided TypeScript runner. Before installing or enabling: 1) Only provide a Civic token with least privilege necessary (avoid admin/global tokens). 2) Be aware the SKILL.md suggests storing the token in ~/.openclaw/openclaw.json (plaintext on disk) — rotate and revoke tokens if you stop using the skill. 3) The token grants access to many downstream services (Gmail, databases, Box); check Civic scopes and trust the Civic account you connect. 4) If you plan to run the TypeScript runner, inspect the included civic-tool-runner.ts (present in the package) and prefer to run it in a controlled environment; installing global tools like mcporter or npm packages can execute code from npm—only install from trusted sources. 5) If you need higher assurance, request the skill publisher/source or verify release provenance (official Civic docs/domains) before use.

Type: OpenClaw Skill Name: openclaw-civic-skill Version: 0.1.0 The skill bundle is a legitimate bridge to the Civic MCP (Model Context Protocol) service, enabling an AI agent to interact with various third-party integrations like Gmail and PostgreSQL. The TypeScript runner (`civic-tool-runner.ts`) is a standard implementation of an MCP client using the official SDK, and the instructions in `SKILL.md` correctly guide the agent on tool discovery and execution without any signs of prompt injection or malicious intent. No evidence of data exfiltration, unauthorized execution, or obfuscation was found.