Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Pipedrive CRM (OpenClaw)
v0.1.0Manage Pipedrive CRM from OpenClaw using API v1, including people, organizations, deals, leads, activities, notes, pipelines, and custom endpoint actions. Us...
⭐ 0· 613·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name, description, SKILL.md, and scripts all consistently implement a Pipedrive API helper (CRUD, search, pipeline movement, raw request passthrough). However the registry metadata lists no primary credential or required environment variables even though the code and documentation clearly expect PIPEDRIVE_API_TOKEN or PIPEDRIVE_ACCESS_TOKEN and PIPEDRIVE_COMPANY_DOMAIN. That metadata omission is an inconsistency.
Instruction Scope
SKILL.md and the scripts limit actions to Pipedrive API calls and setup prompts. Runtime instructions do not direct the agent to read unrelated local files, system credentials, or call external endpoints beyond Pipedrive. Safety rules in SKILL.md explicitly warn not to echo raw tokens.
Install Mechanism
No install spec or third-party downloads; the skill is instruction/code-only and uses only stdlib Python (urllib). No remote installers or archives are fetched.
Credentials
The skill legitimately requires secrets (PIPEDRIVE_API_TOKEN or PIPEDRIVE_ACCESS_TOKEN) and PIPEDRIVE_COMPANY_DOMAIN, but the registry metadata declares none and does not set a primary credential. That mismatch reduces transparency and could lead a user to unknowingly provide credentials to an undeclared skill surface. The number and type of env vars requested by the code are proportionate to the stated purpose, but they are not surfaced in the declared requirements.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or global agent config, and runs only when invoked. It does not request elevated or persistent system privileges.
What to consider before installing
This skill appears to be a straightforward Pipedrive API helper: it needs either a PIPEDRIVE_API_TOKEN (query param auth) or a PIPEDRIVE_ACCESS_TOKEN (Bearer OAuth) and the PIPEDRIVE_COMPANY_DOMAIN. Before installing: (1) note the registry metadata currently does NOT declare these required environment variables or a primary credential — that's an information/visibility gap (not necessarily malicious, but unexpected). (2) Only provide a least-privilege API token or an OAuth token with minimal scopes needed for the operations you'll perform. (3) Review the included scripts (pipedrive-api.py and setup-wizard.py) yourself or run them in a safe environment: they only call pipedrive.com endpoints and do not exfiltrate data to any other domain. (4) If you need stronger assurance, ask the publisher to update registry metadata to declare required env vars and a primary credential; if that is corrected and you validate the code, the skill would appear coherent and reasonable.Like a lobster shell, security has layers — review code before you run it.
latestvk9790pa006bmqx4vn30vz3nxd181fhdr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.