Is aviclaw/debridge-mcp safe?
Yes. aviclaw/debridge-mcp is safe to install. Oathe's behavioral security audit gave the debridge-mcp skill by aviclaw a trust score of 82/100 with 3 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/aviclaw/debridge-mcp
Is aviclaw/debridge-mcp safe to install?
This deBridge MCP skill appears legitimate and provides cryptocurrency cross-chain swap functionality. The main security concerns involve external code execution during setup and the inherent risks of cryptocurrency operations. No evidence of malicious behavior, prompt injection, or data exfiltration was detected.
What security issues were found in aviclaw/debridge-mcp?
Category Scores
Findings (3)
MEDIUM External Repository Code Execution -25 ▶
The setup script clones and executes code from an external GitHub repository (debridge-finance/debridge-mcp). This introduces supply chain risk as the external repository could potentially be compromised or contain malicious code.
MEDIUM npm install Execution Risk -15 ▶
The setup script runs 'npm install' on externally sourced code, which can execute arbitrary scripts defined in package.json (preinstall, postinstall, etc.). This could allow malicious code execution during installation.
LOW Cryptocurrency Operations Context -20 ▶
The skill enables cryptocurrency cross-chain swaps and transfers, which are high-value operations that could be attractive targets for attackers. Users should exercise caution when handling financial transactions.
Should I install aviclaw/debridge-mcp?
Oathe's verdict for aviclaw/debridge-mcp is SAFE with a trust score of 82/100. Recommendation: Install with caution.