mcp-client
Warn
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONNO_CODE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to run
npx clawhub@latest install mcp-client. This executes code from an external, non-whitelisted NPM package from an unknown vendor. Using the@latestversioning introduces a significant supply-chain risk as the package content can change at any time without review. - [NO_CODE]: The skill does not contain any functional logic, scripts, or configurations within its own files. It serves exclusively as a pointer to external installation commands.
- [COMMAND_EXECUTION]: The provided installation sequence requires the user to execute shell commands that download and run code outside the agent's controlled environment. Furthermore, the name 'mcp-client' matches the official Model Context Protocol name, which could lead to confusion regarding its origin. There is also a metadata discrepancy between the provided author ('Demerzels-lab'), the metadata owner ('nantes'), and the source repository ('spooky-may').
Audit Metadata