Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Bigbox
v1.0.2BigBox integration. Manage data, records, and automate workflows. Use when the user wants to interact with BigBox data.
⭐ 0· 85·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description claim BigBox is a cloud storage service, which is consistent with using a connector/proxy. However the SKILL.md also lists actions and an "Official docs" link that reference BestBuy/Home Depot product APIs — this is an internal content mismatch that suggests copy/paste errors or the wrong action list was included. That inconsistency reduces confidence that the skill’s declared purpose aligns with the actual actions described.
Instruction Scope
Instructions are narrowly scoped to installing and using the Membrane CLI, creating connections, listing/running actions, and proxying requests. They do not instruct reading unrelated local files or environment variables. However they do direct the user to perform interactive login flows and to proxy arbitrary API paths through Membrane, which means request payloads and responses will transit Membrane servers — an explicit privacy/network surface to consider.
Install Mechanism
No registry install spec is present, but the SKILL.md instructs installing a global npm package (npm install -g @membranehq/cli). This is a public npm install (moderate-risk action if performed), and it will write binaries to disk. Verify the npm package and its source (npmjs and GitHub) before running a global install.
Credentials
The skill declares no required env vars or credentials and explicitly instructs users not to provide API keys locally (use Membrane connections). That is proportionate. Note: using Membrane means auth happens via Membrane's service, so credentials live/flow through Membrane rather than the local environment.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and requires no special config paths. Autonomous invocation is allowed by default (normal); nothing here increases persistent privileges.
What to consider before installing
This skill appears to be a Membrane CLI integration for a third-party service, but the SKILL.md contains contradictory content (references to BestBuy/Home Depot product APIs while describing a "BigBox" cloud storage service). Before installing or using it: 1) Inspect the @membranehq/cli package on npm and its GitHub repo to confirm authenticity and review permissions/behavior; 2) Verify the correct target service and API endpoints — the "Official docs" link looks wrong; 3) Understand that Membrane will proxy requests and handle auth server-side, so any data you send through actions may pass through Membrane's servers (review Membrane's privacy/security docs); 4) Prefer not to run global npm installs without checking package reputation; 5) If you need stronger assurance, ask the skill author for clarification or a corrected SKILL.md that consistently documents which service and actions this skill is for.Like a lobster shell, security has layers — review code before you run it.
latestvk9756hctyqtq05s7ckgr3sj3hh843fg7
License
MIT-0
Free to use, modify, and redistribute. No attribution required.