mslearn-mcp@1.1.1

CAUTION

Publisher claims: "Ground answers about Azure, .NET, Microsoft 365, Power Platform, Entra ID, Windows and SQL Server in official Microsoft Learn docs and code samples, through Microsoft's free Learn MCP server (native OpenClaw MCP, no API key). Use when the user asks about a Microsoft product, service, API or CLI, or wants an answer checked against Microsoft Learn." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher ricardodpalmeida · joined 0 days agoInstalls 1,646Last detonated 1 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

HIGH

npx invocation of non-well-known packageSKILL.md:49 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/mcp-details.md:42 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL.md:48 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/mcp-details.md:44 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/mcp-details.md:76 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/mcp-details.md:45 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL.md:50 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/mcp-details.md:43 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL.md:47 · npx invocation of non-well-known package — may execute untrusted code

AST06