← 返回 Skills 市场
684
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install outlit-mcp
功能描述
Use when querying Outlit customer data via MCP tools (outlit_*). Triggers on customer analytics, revenue metrics, activity timelines, cohort analysis, churn...
安全使用建议
Key points before installing/using this skill:
- The skill will ask for and use an Outlit MCP API key and tells the agent how to add it to local MCP config files (project .cursor/mcp.json, Claude desktop config in your OS profile) or call a 'claude mcp add' command. The metadata does not list any required credential or config paths — verify this discrepancy with the publisher.
- Do not paste high-privilege or long-lived org-wide API keys into chat. If you try it, prefer a limited-scope, read-only API key created for this skill and rotate/delete it after testing.
- Confirm the endpoint (https://mcp.outlit.ai/mcp) and the publisher are legitimate. There is no homepage or publisher info in the registry metadata, which reduces transparency.
- The skill's instructions will modify files in your project or user profile if followed. Require the agent to ask for explicit permission before writing to any local files or running the 'claude' CLI. If you do not use Claude or .cursor, those steps are unnecessary — ensure the agent checks first.
- If you want to proceed: ask the publisher to update the skill metadata to declare the API key/primary credential and the config paths it will write to, or run the integration manually yourself (add the MCP server entry) rather than letting the agent modify files automatically.
- If unsure, test in an isolated environment (throwaway account or VM) and limit the API key's permissions to read-only/organization-scoped access.
功能分析
Type: OpenClaw Skill
Name: outlit-mcp
Version: 1.0.0
The skill bundle is classified as suspicious due to instructions in `SKILL.md` that involve executing external commands (`claude mcp add`) and directly modifying local configuration files (`.cursor/mcp.json`, `claude_desktop_config.json`). While these actions are presented as legitimate setup steps for the skill to function, they represent risky capabilities (shell execution and file write access) that could be exploited if the agent were compromised or if malicious input were injected. However, there is no clear evidence of intentional harmful behavior such as data exfiltration, backdoor installation, or unauthorized remote control; the `outlit_query` tool is explicitly restricted to 'SELECT only' SQL queries, limiting its malicious potential.
能力评估
Purpose & Capability
The skill purports to provide read-only analytics access to Outlit via MCP tools (outlit_*), which matches the documented tools and queries. However, the SKILL.md explicitly requires an API key and instructs adding an MCP server entry (Authorization: Bearer API_KEY) to local MCP configs/CLI, while the skill metadata declares no primary credential, no required env vars, and no required config paths — an incoherence between declared requirements and actual setup steps.
Instruction Scope
Runtime instructions tell the agent to detect the environment and modify local configuration files (project/.cursor/mcp.json, ~/Library/Application Support/Claude/claude_desktop_config.json, %APPDATA%/Claude/...), or run a CLI command (claude mcp add ...). Those are outside of pure query semantics and grant the skill the ability to write to user config locations unless the agent explicitly asks the user first. The instructions also require asking the user for their API key if not provided, which implies handling secrets during runtime.
Install Mechanism
There is no install spec and no code files to execute — this is instruction-only, which minimizes written-to-disk risk. The skill references an external MCP endpoint (https://mcp.outlit.ai/mcp) but does not instruct downloading arbitrary code.
Credentials
Requesting an Outlit API key is proportional to the stated purpose (service access). However, the skill metadata does not declare any required environment variable or primary credential while the instructions clearly require a secret API_KEY and show writing it into local config files — this mismatch is suspicious and reduces transparency about what secrets will be used/stored.
Persistence & Privilege
always:false (good). But the instructions explicitly tell the agent how to persist the API key into various MCP configuration files and to call a CLI to register the server; that means the skill, if followed automatically, could cause persistent credential storage in user config locations. The metadata didn't disclose these config paths, so the skill would gain persistent presence in user config without that being advertised.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install outlit-mcp - 安装完成后，直接呼叫该 Skill 的名称或使用
/outlit-mcp触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release of the Outlit MCP skill for querying customer intelligence data via MCP tools.
- Supports six tools: customer and user browsing, deep dives, timelines, custom SQL analytics, and schema discovery.
- Detailed parameter and usage guides for each tool (outlit_list_customers, outlit_list_users, outlit_get_customer, outlit_get_timeline, outlit_query, outlit_schema).
- Comprehensive setup instructions for API key and MCP integration across multiple environments (Claude Code, Cursor, Claude Desktop).
- Includes best practices, gotchas, data model overview, and known limitations.
- Emphasizes always discovering schema before writing SQL and filtering at the source for performance.
元数据
常见问题
Outlit MCP 是什么？
Use when querying Outlit customer data via MCP tools (outlit_*). Triggers on customer analytics, revenue metrics, activity timelines, cohort analysis, churn... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 684 次。
如何安装 Outlit MCP？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install outlit-mcp」即可一键安装，无需额外配置。
Outlit MCP 是免费的吗？
是的，Outlit MCP 完全免费（开源免费），可自由下载、安装和使用。
Outlit MCP 支持哪些平台？
Outlit MCP 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Outlit MCP？
由 leo-paz（@leo-paz）开发并维护，当前版本 v1.0.0。
推荐 Skills