Zapier MCP

Connect 8,000+ apps via Zapier MCP. Includes full UI integration for Clawdbot Gateway dashboard. Use when setting up Zapier integration, connecting apps, or...

This skill appears coherent and implements a Zapier MCP integration as described. Before installing, consider: 1) mcporter will be required and the skill will read/write your mcporter config file in your home directory — back up ~/.config/mcporter/config.json or any existing mcporter config if you care about existing entries. 2) The skill will send POST requests to whatever MCP URL you paste; only use MCP URLs you trust (a malicious MCP server could execute actions you didn't intend). 3) Confirm that mcporter on your system is the expected tool and source (install from the official package). 4) The code includes a couple of home-path variants (e.g., "clawd" vs "clawdbot"); this is likely just trying multiple candidate locations but you may want to inspect the config file it writes after saving. If you want stronger isolation, test the integration in a sandbox or VM before adding real accounts or production data.

Type: OpenClaw Skill Name: zapier-mcp Version: 1.0.0 The skill is suspicious due to insufficient validation of the user-provided `mcpUrl` in `reference/zapier-backend.ts`. While the URL is checked for HTTPS and a basic `tools/list` response, a malicious server could mimic Zapier's API, allowing an attacker to hijack the agent's communication with Zapier and potentially intercept or manipulate subsequent `mcporter call` requests. This represents a significant vulnerability where a user could be tricked into configuring a malicious endpoint, leading to potential compromise of agent actions or data, even though the skill itself does not exhibit explicit malicious intent.