by 安全扫描
OpenClaw
安全
high confidenceThe skill's instructions, requirements, and outputs are consistent with its stated purpose of scaffolding a TypeScript MCP server and do not request unrelated secrets, installs, or elevated persistence.
评估建议
This skill appears coherent for scaffolding an MCP TypeScript project. Before using the generated project, review the output: remove or replace placeholder absolute paths, do not paste real secrets into the generated config snippets, confirm the dependency (@modelcontextprotocol/sdk) is intended, and audit any generated code before running or publishing. If you want the scaffold to use relative paths or a specific build location, state that explicitly when invoking the skill.详细分析 ▾
✓ 用途与能力
Name and description (scaffolding a TypeScript MCP server) align with the SKILL.md: it only describes generating project files, package.json with @modelcontextprotocol/sdk, transport config snippets, and README. No unrelated binaries, services, or credentials are requested.
ℹ 指令范围
Instructions stay within scaffolding scope (generate files, tool definitions, config snippets). Two items to note: (1) the stdio config example uses an absolute path for the build artifact — agents producing scaffolds should avoid embedding real absolute paths without user confirmation; (2) the skill tells the agent how to choose transport (stdio vs HTTP) and mentions local file-system/CLI usage for stdio, which is appropriate for scaffolding but could lead to generated code that expects filesystem access when run. The SKILL.md does not instruct the agent to read user's files, env vars, or other system state.
✓ 安装机制
Instruction-only skill with no install spec and no code files — nothing will be downloaded or written by an installer. This is the lowest-risk install model.
✓ 凭证需求
The skill declares no required environment variables or credentials. It does instruct generating a .env.example documenting env vars for the scaffolded project, which is expected and proportionate; it does not request or access any secrets itself.
✓ 持久化与权限
always is false and the skill is user-invocable with normal autonomous invocation behavior. It does not request permanent presence, nor does it instruct modifying other skills or agent-wide settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/2
Initial release of mcp-scaffolder: scaffold a complete MCP server from a single description. - Generates full folder structure (src, tools, config, README, env doc) for an MCP server project - Creates typed, documented tool definitions with input schemas and JSDoc for Claude Code integration - Sets up transport config (stdio or HTTP) automatically based on use case, excluding deprecated SSE - Outputs ready-to-paste Claude MCP add config snippet for immediate use - README includes setup, env vars, and usage with Claude Code - Defaults to TypeScript for all generated code unless specified otherwise
● 无害
安装命令
点击复制官方npx clawhub@latest install mcp-scaffolder
镜像加速npx clawhub@latest install mcp-scaffolder --registry https://cn.longxiaskill.com 镜像可用
本土化适配说明
MCP Scaffolder — MCP 脚手架 安装说明： 安装命令：npx clawhub@latest install mcp-scaffolder
技能文档
# MCP Scaffolder Skill When the user describes an MCP server they want to build, scaffold it completely.
什么 到 Generate
- Folder structure
- Server entry point (src/索引.ts)
- Tool definitions
- Claude Code 配置 snippet
- README
Rules
- Never 使用 SSE transport — deprecated, 使用 HTTP 代替
- Always include server instructions 字段 在...中 entry point
- Keep tool descriptions specific — Claude Code uses these 对于 tool 搜索
- 标志 任何 必填 env vars 在...中 .env.示例 带有 评论 explaining 什么 它们 对于
- 使用 TypeScript 由 默认 unless 用户 specifies 否则