ScopeBlind Red Team

Policy benchmarking runner for MCP security policies. Runs attack suites against protect-mcp policy packs, produces signed receipts and badges.

This skill appears to do what it says (run red-team checks against protect-mcp policies) but exercise caution: 1) The SKILL.md tells you to run a global 'npm install -g' — that will download and execute code from npm, so only proceed if you trust the @scopeblind and protect-mcp packages and their maintainers. 2) Verify you have Node/npm/npx installed (the registry metadata omitted this requirement). 3) Ask or inspect how 'signed receipts' are produced and where badges are sent — if signing requires keys or network uploads, confirm what credentials are needed and whether they will be transmitted externally. 4) Prefer testing in a disposable environment (container or VM) and, if possible, review the npm package source before installing. If you want, I can fetch the npm package pages and summarize their maintainers, versions, and homepage info to help decide whether to trust them.

Type: OpenClaw Skill Name: scopeblind-red-team Version: 0.1.1 The skill installs global npm packages (@scopeblind/red-team and protect-mcp) and executes 'attack suites' via npx as described in SKILL.md. While these actions are consistent with the stated purpose of security policy benchmarking, the execution of external code designed to simulate attacks is a high-risk capability. There is no direct evidence of malicious intent in the provided files, but the reliance on external, unverified payloads warrants caution.