Exepal

Skill Check (is this agent skill safe to install?)

skill_check

Read-onlyIdempotent

Skill Check: scans an OpenClaw / ClawHub, Claude Code or Codex skill (SKILL.md and its scripts) before you install it, for the patterns used by the 2026 ClawHub malware skills: paste-in-Terminal set-up steps, download-and-run, password-protected archives, macOS quarantine bypass, fake password dialogs, Keychain, browser, wallet and agent-key theft, reverse shells, hidden instructions and leaked secrets. Use before installing or enabling any agent skill you did not write: a ClawHub skill (pass its link or slug), a GitHub skill folder or repo, a raw SKILL.md URL, or pasted text / files[]. Fetches every text file of the skill (up to 30) and lists binaries it can't read. Returns verdict (safe, careful, dont_install), score 0-100 (higher is riskier), name and description from SKILL.md, findings[] {file, rule, severity, message, evidence, line}, counts {high, medium, low}, files[], skipped[], urls[], source {type clawhub/github/url/pasted, ref, version, clawhubFlag} and summary. Rules, not a model; nothing is stored. Not charged when the skill can't be fetched. Price: $0.005 per call from Exepal credit; not charged if the call fails. Includes free daily calls.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "skill_check"
  }
}

Input Schema

Name	Required	Description
`url`	No	A ClawHub skill link or slug (clawhub.ai/owner/skill), a GitHub link to a skill folder or repo, or a raw SKILL.md URL
`path`	No	With text: its file name (default SKILL.md)
`text`	No	Instead of url: the SKILL.md content (up to 300,000 characters)
`files`	No	Instead of url: up to 30 files {path, text} of the skill

Output Schema

Name	Required	Description
`name`	No	From SKILL.md front matter
`urls`	No
`files`	No
`score`	No	0-100, higher is riskier
`counts`	No
`source`	No
`skipped`	No	Files listed but not scanned
`summary`	No
`verdict`	No	safe, careful or dont_install
`findings`	No
`checkedAt`	No	ISO 8601
`free_left`	No
`description`	No

Schema Changelog

Changes observed during successful MCP inspections.

AddedNov 9, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/idempotent/openWorld annotations, it discloses operational behavior the annotations cannot: fetching up to 30 text files, listing binaries it cannot read, rule-based (not model) analysis, nothing stored, no charge when the skill can't be fetched, and the $0.005 price with free daily calls. That is exactly the kind of context annotations omit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose, threat list, when-to-use, accepted inputs, return shape and pricing are packed into one dense block that is front-loaded correctly. The sentence enumerating every malware pattern is long and slightly listy, and the return-value enumeration is redundant with the output schema, but little is pure waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a security-scan tool with four optional params, annotations and an output schema, the description covers trigger, inputs, analysis method, cost and failure semantics. An agent has everything needed to decide to call it and to supply the right parameter combination.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds the mutually exclusive framing — pass a ClawHub link or slug, a GitHub folder/repo, a raw URL, or instead pasted text/files[] — which helps an agent choose between the four optional params. It does not add syntax detail beyond what the schema already carries.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource — scans an OpenClaw/ClawHub, Claude Code or Codex skill (SKILL.md plus scripts) before install — and enumerates the exact threat patterns it looks for. This clearly separates it from siblings like scan_mcp, scan_secrets or scan_injection, which target different artifacts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a crisp trigger: 'Use before installing or enabling any agent skill you did not write', and maps accepted input modes (ClawHub link/slug, GitHub folder/repo, raw SKILL.md URL, pasted text or files[]). It does not state when NOT to use it or name which sibling to pick for adjacent needs, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Exepal tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?