RankClaw

RankClaw — AI Agent Trust Layer. Check any ClawHub, OpenClaw, nanobot, nanoclaw, picoclaw, or MCP server skill against 14,700+ indexed tools before installin...

RankClaw appears to be what it says (a remote skill-auditing service) but it asks you to add a persistent MCP server that sends agent requests to https://api.rankclaw.com. Before installing or adding it to your agent config: 1) Do not send secrets or local files to the service until you confirm what data is transmitted — test rankclaw_check using innocuous skill names first. 2) Inspect the bundled mcp_bridge.py (it is a simple HTTP→stdio proxy) and prefer using the bundled file rather than curling at runtime; note the example filename mismatch (mcp_bridge.py vs rankclaw_mcp_bridge.py) — fix it if you deploy. 3) Treat the prompt-injection finding seriously: open SKILL.md and SECURITY_AUDIT.md and verify there are no hidden/obfuscated instructions telling the agent to ignore safeguards. 4) Ask the maintainer for a privacy/security policy and the server-side audit code or allow-listing mechanism (what exactly is sent to the server, retention policy, and whether SKILL.md or other local files are uploaded). 5) If you have sensitive credentials or run agents with host-level access, avoid persistent registration of third-party MCP servers; instead run checks manually or self-host an audit service. If you want, I can produce a short checklist of exact MCP RPCs to test or help craft a minimal test invocation that doesn't leak sensitive data.

Type: OpenClaw Skill Name: rankclaw Version: 2.1.0 The RankClaw skill is a security trust layer for AI agents, designed to audit other skills. Its `SKILL.md` provides legitimate instructions for agents to integrate and use its security checking services, including downloading and executing the `mcp_bridge.py` script from its GitHub repository. The `mcp_bridge.py` script functions as a benign proxy, forwarding JSON-RPC requests to the declared `https://api.rankclaw.com/api/mcp/` endpoint without any unauthorized file system access, credential handling, or arbitrary code execution. The `SECURITY_AUDIT.md` file is meta-documentation for human analysts and does not contain executable code or agent instructions. All observed behaviors are consistent with the skill's stated purpose, with no evidence of malicious intent or significant vulnerabilities.