Pipeworx domains — 技能工具
v1.0.0Search registered domain names by keyword and TLD — find what's taken via Domainsdb.info
0· 42·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill mostly does what it says (search domains) but the documentation claims 'via Domainsdb.info' while its runtime examples call an external Pipeworx gateway and even recommend running npx mcp-remote@latest — this mismatch and the suggestion to fetch/run remote npm code create supply‑chain and privacy concerns.
评估建议
This skill will send your domain queries to https://gateway.pipeworx.io; if you expect it to query Domainsdb.info directly, that claim is inaccurate. Avoid running 'npx mcp-remote@latest' from an untrusted source — fetching the latest npm package executes remote code. If you care about confidentiality of brand/domain ideas, either (a) use the curl JSON-RPC example and review the gateway URL before sending sensitive queries, (b) contact the skill author for clarification and a pinned package/hash...详细分析 ▾
⚠ 用途与能力
The name/description claim searching domains 'via Domainsdb.info', but the SKILL.md shows all runtime calls going to https://gateway.pipeworx.io/domains/mcp. That is an inconsistency: either the skill proxies Domainsdb.info or it uses Pipeworx; the manifest should be explicit. Requiring only curl is proportionate for a simple search helper.
ℹ 指令范围
Instructions are narrow and only demonstrate POSTing JSON-RPC queries (query, zone, limit) to the Pipeworx gateway; they do not ask to read local files or environment variables. However, the SKILL.md suggests using npx mcp-remote to connect to the gateway — which implies executing remote code and sending user queries off‑host (possible logging/exfiltration of brand/domain research).
⚠ 安装机制
No formal install spec in the registry (instruction-only), but the README recommends running 'npx -y mcp-remote@latest'. That pulls and executes code from npm dynamically (latest tag) and creates a supply‑chain risk. The curl-only example is low-risk, but the npx recommendation raises installation/execution concerns.
✓ 凭证需求
The skill declares no required environment variables, credentials, or config paths — that is appropriate for a read-only domain search. There are no hidden env requirements in the SKILL.md.
✓ 持久化与权限
The skill does not request always:true or other elevated persistence. The MCP config snippet suggests adding an mcpServers entry to local config, but that's optional and not enforced by the registry metadata.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/9
Initial release
● 无害
安装命令
点击复制官方npx clawhub@latest install pipeworx-domains
镜像加速npx clawhub@latest install pipeworx-domains --registry https://cn.longxiaskill.com 镜像可用
本土化适配说明
Pipeworx domains — 技能工具 安装说明： 安装命令：npx clawhub@latest install pipeworx-domains
技能文档
Search for registered domain names matching a keyword. Filter by TLD zone (.com, .net, .io, etc.) to see what's already taken. Useful for brand research, competitive analysis, and domain name brainstorming.
Tools
search_domains— Search registered domains by keyword, optionally filtered by TLD. Returns domain names, creation dates, and update timestamps.
When to use
- Checking if variations of a brand name are registered
- Competitive research — see who owns domains around a keyword
- Domain squatting analysis for a particular term
- Brainstorming domain names by seeing what patterns are taken
Example: search for "weather" domains in .io
curl -s -X POST https://gateway.pipeworx.io/domains/mcp \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search_domains","arguments":{"query":"weather","zone":"io","limit":5}}}'
MCP config
{
"mcpServers": {
"pipeworx-domains": {
"command": "npx",
"args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/domains/mcp"]
}
}
}