安全扫描
OpenClaw
安全
high confidenceThe skill's code, assets, and runtime instructions align with its stated purpose (scaffolding and implementing MCP Apps); there are no disproportionate credentials, hidden network endpoints, or unexpected install steps.
评估建议
This appears to be a legitimate MCP App scaffolding template. Before installing or running it: (1) review and, if desired, pin/verify the npm dependencies in package.json (trust the @modelcontextprotocol packages used); (2) run builds and the server locally first — the template serves local HTML from the dist/ directory; (3) be cautious if you follow the instructions to expose your dev server with a tunnel (e.g., cloudflared) because that makes your local service publicly reachable; and (4) ther...详细分析 ▾
✓ 用途与能力
Name/description match the included assets and SKILL.md: a runnable MCP App template (server + single-file React UI) and an authoritative spec. Required files, dependencies, and patterns (registerAppTool/registerAppResource, createServer(), createMcpExpressApp, vite single-file) are coherent with the stated goal; no unrelated credentials, binaries, or config paths are requested.
ℹ 指令范围
Instructions are narrowly focused on scaffolding, implementing, building, and serving MCP Apps using the provided template and exact dependency versions. They read local project files (e.g., serving built HTML from dist/) and suggest optionally exposing the local server via a tunnel (cloudflared) for testing — that exposure is operationally risky if done insecurely but is not itself malicious. The SKILL.md does not instruct reading secrets or arbitrary host files.
✓ 安装机制
No install spec is included (instruction-only), and the template relies on standard npm/tsx tooling declared in package.json. There are no download URLs or archives that would write arbitrary code at install time.
✓ 凭证需求
The skill declares no required environment variables or credentials. The code uses non-secret env values (PORT and build INPUT) only. There are no requests for unrelated tokens/keys or access to other skill configs.
✓ 持久化与权限
always is false, the skill is user-invocable and may be invoked autonomously (platform default). It does not request permanent presence, nor does it modify other skills or system-wide settings.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/2/27
Initial release of mcp-app-builder. - Provides a detailed workflow for scaffolding MCP Apps with React UI using @modelcontextprotocol/ext-apps and the MCP SDK. - Enforces strict requirements for dependency versions and server/UI structure following mcp-app-spec.md. - Includes guidance for server and UI implementation, testing, and theming. - Supplies reference templates and assets to speed up app development.
● 无害
安装命令 点击复制
官方npx clawhub@latest install mcp-app-builder
镜像加速npx clawhub@latest install mcp-app-builder --registry https://cn.clawhub-mirror.com
技能文档
Overview
Create MCP Apps that expose tools with visual React UIs for ChatGPT or Claude. Follow the exact dependency versions and server/UI patterns inreferences/mcp-app-spec.md.Workflow
- Clarify requirements: what data to visualize, UI pattern (card, table, chart, dashboard, form), data source, and how many tools (start with 1-2).
- Design tools and UI mapping: define tool names, zod input schemas, output shape, and UI resource URIs (
ui://.../app.html). Map each tool to one React entrypoint and one HTML file. - Scaffold the project: start from
assets/mcp-app-template/when possible, then customize tool names, schemas, and UI. Ensurepackage.jsonuses the exact versions, plustsconfig.json,vite.config.ts, Tailwind + PostCSS, and per-tool build scripts. - Implement the server: use
registerAppTool/registerAppResource, zod schemas directly,createServer()factory per request, andcreateMcpExpressAppwithapp.all("/mcp", ...). - Implement the UI: use
useApp+useHostStyles, parse tool results, handle loading/error/empty states, and apply safe-area insets. - Build and test: run
npm run build, thennpm run serve, then verify via a tunnel if needed.
Hard Requirements
- Use the exact dependency versions listed in
references/mcp-app-spec.md. - Use
registerAppTool/registerAppResourceand zod schemas directly (not JSON Schema objects). - Create a new
McpServerinstance per request viacreateServer(). - Use
createMcpExpressAppandapp.all("/mcp", ...). - Bundle UI into single-file HTML via
vite-plugin-singlefile. - Use host CSS variables for theme compatibility.
References
references/mcp-app-spec.md(authoritative spec, patterns, code templates, gotchas)
Assets
assets/mcp-app-template/(ready-to-copy MCP App skeleton with one tool + UI)
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制