← 返回 Skills 市场
ProofTrail MCP Skill
作者
Yifeng[Terry] Yu
· GitHub ↗
· v0.1.1
· MIT-0
113
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install prooftrail-mcp
功能描述
Teach an agent to install ProofTrail's governed stdio MCP server, use the safest read and proof tools first, and keep future package or listing claims honest.
安全使用建议
This packet is internally consistent and appears to do what it claims: guide you to attach a repo-local ProofTrail stdio MCP server and prefer read/proof tools first. Before running anything: (1) inspect the GitHub repo (https://github.com/xiaojiou176-open/prooftrail.git) and review package.json scripts and pnpm install effects; (2) substitute the correct local cwd path in the provided config snippets; (3) only set UIQ_MCP_API_BASE_URL and any token env vars if you trust the backend and need live reads; (4) treat 'publish-ready' npm/Docker names as unpublished until you verify they exist. The skill contains no declared secrets or hidden endpoints, but cloning and running a third‑party repo can execute arbitrary code—review the repo before use.
功能分析
Type: OpenClaw Skill
Name: prooftrail-mcp
Version: 0.1.1
The skill bundle instructs the AI agent to perform high-risk supply chain operations, specifically cloning a remote GitHub repository (github.com/xiaojiou176-open/prooftrail.git) and executing 'pnpm install' and 'pnpm mcp:start' (as detailed in references/INSTALL.md). While these actions are consistent with the stated purpose of setting up a local MCP server, they create a significant risk of Remote Code Execution (RCE) through untrusted third-party code or malicious npm lifecycle scripts, lacking any verification or sandboxing mechanisms.
能力标签
能力评估
Purpose & Capability
The name and description (install and use a repo-local ProofTrail stdio MCP server and prefer read/proof tools first) match the instructions and included reference files. The manifest, CAPABILITIES.md, and demo all align with that stated purpose. Nothing in the package asks for unrelated capabilities.
Instruction Scope
SKILL.md and the reference docs focus on cloning the ProofTrail repo, running pnpm commands, attaching a repo-local stdio MCP server, and using safe-first tooling. The instructions do not ask the agent to read arbitrary host files, exfiltrate data, or contact unknown endpoints; they only note optional backend reads (UIQ_MCP_API_BASE_URL and 'any required token env vars') when live backend access is explicitly needed.
Install Mechanism
This is an instruction-only skill (no install spec or code included). The recommended install is to git clone https://github.com/xiaojiou176-open/prooftrail.git and run pnpm install / pnpm mcp:start. That is coherent with the purpose, but cloning and running a third-party repo executes code from an external source—normal for this use case but a security consideration the user must evaluate separately.
Credentials
The package declares no required env vars or credentials. The docs responsibly call out that if a real backend is needed the operator may set UIQ_MCP_API_BASE_URL and any backend token env vars; those are optional and consistent with the documented 'local-with-optional-backend-token' auth.
Persistence & Privilege
always is false and there is no install-time code or hooks that would modify other skills or system-wide settings. The skill is an instruction packet only and does not request elevated persistence or privileges.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install prooftrail-mcp - 安装完成后，直接呼叫该 Skill 的名称或使用
/prooftrail-mcp触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v0.1.1
ProofTrail MCP Skill v0.1.1
- Adds clear step-by-step instructions for installing and connecting the ProofTrail governed MCP server from a local repo.
- Emphasizes a safe-first workflow: start with catalog and read tools before running broader automation or proofs.
- Distinguishes between current repo-native usage and unlaunched package/Docker distribution; notes future publication plans without overclaiming.
- Lists strong boundaries: this is not a hosted service or store listing, and doesn't provide generic browser bot automation.
- Provides condensed guides and references to onboard new users safely and honestly.
元数据
常见问题
ProofTrail MCP Skill 是什么？
Teach an agent to install ProofTrail's governed stdio MCP server, use the safest read and proof tools first, and keep future package or listing claims honest. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 113 次。
如何安装 ProofTrail MCP Skill？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install prooftrail-mcp」即可一键安装，无需额外配置。
ProofTrail MCP Skill 是免费的吗？
是的，ProofTrail MCP Skill 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
ProofTrail MCP Skill 支持哪些平台？
ProofTrail MCP Skill 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 ProofTrail MCP Skill？
由 Yifeng[Terry] Yu（@xiaojiou176）开发并维护，当前版本 v0.1.1。
推荐 Skills