Swiggy

Order food, groceries, and book restaurants in India via Swiggy's MCP servers. Food delivery, Instamart groceries, and Dineout restaurant bookings with safety-first confirmation workflow.

This skill appears to do what it says: it wraps mcporter to call Swiggy MCP servers and requires Node and the mcporter skill. Before installing: 1) Note the source/homepage is missing — verify the author or obtain the package from a trusted registry. 2) Ensure you install and trust the mcporter skill, since mcporter will handle OAuth and network access to https://mcp.swiggy.com/*. 3) Be aware SKILL.md promises logging to memory/swiggy-orders.json and address mapping from USER.md but the CLI doesn't implement those; if you rely on those features, inspect/modify the code. 4) The CLI shells out using execSync with JSON-inserted arguments — treat inputs carefully and avoid passing untrusted/unsanitized values. 5) Test in a controlled environment and verify OAuth prompts and account behavior (COD-only and orders reportedly non-cancellable). If you need higher assurance, ask the author for provenance or a signed release, or have a developer review/patch the small mismatches noted above.

Type: OpenClaw Skill Name: swiggy Version: 1.0.5 The skill is designed to interact with Swiggy's MCP servers for food, groceries, and restaurant bookings. Both the `SKILL.md` instructions and the `swiggy-cli.js` code implement robust safety checks, most notably requiring an explicit `--confirm` flag for all ordering and booking actions. The `swiggy-cli.js` uses `execSync` to call the `mcporter` utility, but this is done with hardcoded, legitimate Swiggy MCP server URLs and structured arguments, preventing arbitrary command execution or data exfiltration. There is no evidence of malicious intent, credential theft, persistence mechanisms, or harmful prompt injection attempts; in fact, the `SKILL.md` actively guides the agent towards safe, user-confirmed interactions.