📦 Lawmatics API MCP — 法律CRM接口
v1.0.0将 Lawmatics 法律 CRM 的 REST API 以只读 MCP 工具形式暴露，供 AI 快速查询客户、案件与营销数据，无需编写鉴权代码。
0· 296·0 当前·0 累计
by 下载技能包
最后更新
2026/3/11
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
Before installing: verify the origin and code of the lawmatics-mcp binary (the SKILL.md links to an npm package—review that package and its publisher). Ask the skill author or vendor how the connector authenticates to Lawmatics (you should expect an API key/token) and why that credential is not declared. Treat NODE_MCP_SECRET_KEY as a sensitive secret—find out what it authenticates against. If you must run this, run the binary in an isolated environment, inspect network calls (to detect unexpect...详细分析 ▾
ℹ 用途与能力
Name/description align with requiring an mcporter client and a lawmatics-mcp server binary. However, for a connector that exposes the Lawmatics REST API one would typically expect the skill to declare or request the Lawmatics API credentials (API key/token) or document where that config comes from. The single required env var (NODE_MCP_SECRET_KEY) looks like a local MCP secret, not the Lawmatics API credential.
ℹ 指令范围
SKILL.md only instructs using mcporter to list/call tools over stdio and references the npm package. It does not instruct reading unrelated files or system paths. The instructions are minimal/vague (no startup steps, no config guidance), which is reasonable for an instruction-only skill but leaves unanswered how the adapter authenticates to Lawmatics.
✓ 安装机制
There is no install spec (instruction-only), so nothing would be written to disk by the skill itself. The SKILL.md links to an npm package, but the skill doesn't provide an install or provenance for the required binaries; the user/host must supply them.
⚠ 凭证需求
The skill requires NODE_MCP_SECRET_KEY (likely a local MCP auth secret) but does not request any Lawmatics API credentials (tokens/keys). A Lawmatics connector normally needs the CRM API key—its absence is unexpected and unexplained. Requiring a secret named NODE_MCP_SECRET_KEY without clarifying its scope or usage is also potentially sensitive.
✓ 持久化与权限
Skill is not always:true and does not request any system config paths. Model invocation is allowed (the platform default), which is expected for skills. No evidence it attempts to modify other skills or global agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/11
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install lawmatics-mcp
镜像加速npx clawhub@latest install lawmatics-mcp --registry https://cn.longxiaskill.com