← 返回 Skills 市场
Pipeworx art
作者
Bruce Gutman
· GitHub ↗
· v1.0.0
· MIT-0
91
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install pipeworx-art
功能描述
Search and explore 500,000+ artworks in the Metropolitan Museum of Art's open-access collection
安全使用建议
This pack appears to provide Met Museum data, but it routes calls through an external Pipeworx gateway and recommends using 'npx -y mcp-remote@latest' — which will download and execute code from npm at runtime. Before installing: (1) confirm you trust https://gateway.pipeworx.io and the pipeworx project; (2) verify the mcp-remote package source (review its code/release) and add Node/npx to declared requirements; (3) consider requiring the skill to call the Met's official API (collectionapi.metmuseum.org) directly if you prefer no third-party proxy; (4) run this skill in a sandboxed environment or restrict agent permissions if you allow it; (5) if you are unsure about executing remote npm packages, do not enable autonomous invocation or avoid installing the skill.
功能分析
Type: OpenClaw Skill
Name: pipeworx-art
Version: 1.0.0
The skill bundle provides a legitimate interface to the Metropolitan Museum of Art's open-access collection via a remote MCP server. It uses standard connectivity patterns (npx mcp-remote) to interact with the gateway.pipeworx.io endpoint and contains no evidence of malicious intent, data exfiltration, or prompt injection.
能力评估
Purpose & Capability
The description says it connects to the Met's open-access API, but the runtime example and setup point to https://gateway.pipeworx.io/art/mcp (a proxy/gateway) rather than the Met's official endpoints. The SKILL.md's Setup also instructs using npx to run mcp-remote, yet 'npx' / Node is not listed in the required binaries — a clear mismatch between claimed dependencies and actual instructions.
Instruction Scope
Instructions include POSTing JSON-RPC calls to a third-party gateway and recommend configuring an mcpServer that will run 'npx -y mcp-remote@latest https://gateway.pipeworx.io/art/mcp'. That effectively instructs the agent/runtime to fetch and execute code from npm and to use a remote service as the tool backend. The SKILL.md does not instruct reading local files or secrets, but it does delegate runtime behavior to an external, unreviewed component.
Install Mechanism
There is no formal install spec, but the Setup suggests invoking npx to fetch and run mcp-remote@latest from npm. Using npx downloads and executes package code at runtime from the public registry — moderate-to-high risk if the package or the gateway is untrusted. The Skill fails to declare Node/npx as a required binary, which is inconsistent and could cause unnoticed remote code execution.
Credentials
The skill declares no required environment variables or credentials, which is proportionate for a read-only art catalog. However, because it routes requests through a third-party gateway and a remote npm tool, additional implicit network access and potential token use could occur but are not declared.
Persistence & Privilege
always is false (good), but autonomous model invocation is allowed (default). Combined with the setup that causes the agent/runtime to fetch and run mcp-remote from npm and to send JSON-RPC to an external gateway, this increases the blast radius: the agent could autonomously run unvetted remote code and communicate with a third-party service.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install pipeworx-art - 安装完成后，直接呼叫该 Skill 的名称或使用
/pipeworx-art触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release
元数据
常见问题
Pipeworx art 是什么？
Search and explore 500,000+ artworks in the Metropolitan Museum of Art's open-access collection. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 91 次。
如何安装 Pipeworx art？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install pipeworx-art」即可一键安装，无需额外配置。
Pipeworx art 是免费的吗？
是的，Pipeworx art 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Pipeworx art 支持哪些平台？
Pipeworx art 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Pipeworx art？
由 Bruce Gutman（@brucegutman）开发并维护，当前版本 v1.0.0。
推荐 Skills