Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Appcues
v1.0.2Appcues integration. Manage data, records, and automate workflows. Use when the user wants to interact with Appcues data.
⭐ 0· 62·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to integrate with Appcues and the SKILL.md header explicitly says it 'Requires network access and a valid Membrane account.' Yet the registry metadata lists no required environment variables, no primary credential, and no config paths. A legitimate Appcues integration would normally require either Appcues API credentials or a declared Membrane API token; the absence of any declared credential is inconsistent.
Instruction Scope
This is an instruction-only skill and the header indicates it will call external services. Because SKILL.md is the runtime instruction surface, the fact it references a Membrane account/network access means the agent will contact external endpoints and/or prompt for authentication at runtime. The provided manifest is missing explicit guidance about which endpoints/credentials will be used and what data will be sent, creating scope ambiguity—Appcues data can include user records and PII, so clarity is important.
Install Mechanism
No install spec and no code files — lowest friction and nothing is written to disk by the skill package itself. Installation mechanism risk is low for this package format.
Credentials
The SKILL.md requires a Membrane account but the skill declares no required env vars or primary credential. That omission is disproportionate: the skill will likely need an API key/token to act on Appcues data (either Appcues credentials or a Membrane token). The current metadata does not declare where secrets should be provided or what scope they need, which is a red flag.
Persistence & Privilege
always: false and user-invocable: true — the skill does not request forced permanent inclusion. It does not include an installer or self-modifying behavior in the package, so persistence and privilege requests appear appropriate.
What to consider before installing
Don't install or supply credentials yet. Ask the publisher to clarify (and update the registry metadata) which credential is required: a Membrane API token or direct Appcues API key, the exact endpoints the skill calls, and what data fields are transmitted. Verify the Membrane homepage/repository (https://getmembrane.com and the linked GitHub) to confirm the publisher identity and review their security/privacy docs. If you must try it, use a scoped test account or token with minimal permissions and avoid using production API keys or PII. Prefer skills that declare their required env vars/primary credential in the registry and list exact network endpoints they call.Like a lobster shell, security has layers — review code before you run it.
latestvk9782vmdwasegg7tyen50vfv3h84275e
License
MIT-0
Free to use, modify, and redistribute. No attribution required.