Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Bridge
v1.0.0Bridge integration. Manage data, records, and automate workflows. Use when the user wants to interact with Bridge data.
⭐ 0· 57·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill describes a Bridge integration and exclusively uses the Membrane CLI/proxy to interact with Bridge APIs, which is coherent with the stated purpose. However the SKILL.md includes an odd 'Official docs' link to an Atlassian/Trello API page (likely unrelated) — this mismatch should be clarified by the publisher.
Instruction Scope
Instructions are limited to installing and using the Membrane CLI, logging in, creating connections, listing/running actions, and proxying requests to Bridge. That scope is appropriate for the described integration, but the proxy behavior means API calls and potentially sensitive data will be routed through Membrane's servers (the SKILL.md says this explicitly).
Install Mechanism
There is no registry install spec, but the instructions tell the user/agent to install a global npm package (npm install -g @membranehq/cli) and elsewhere use npx @membranehq/cli@latest. These are unpinned, inconsistent, and involve running third‑party code from the npm registry — a moderate risk. The skill does not provide integrity checks or a pinned version.
Credentials
The skill requests no local env vars or credentials (it directs authentication through Membrane). That is proportionate, but it also means credentials and API traffic are handled server‑side by Membrane; users should be aware that access tokens and potentially sensitive Bridge data will transit and be stored/managed by that third party.
Persistence & Privilege
The skill is instruction‑only, has no install spec in the registry, does not request always:true, and does not declare any config paths or persistent privileges. It does not attempt to modify other skills or agent-wide settings.
What to consider before installing
Before installing or using this skill: 1) Verify the Membrane project and vendor (getmembrane.com / GitHub repository) and read their privacy/security policy to understand how they handle credentials and data. 2) Prefer using a pinned CLI version (avoid unpinned npm install -g or npx @latest) or request a checksum/signature for the package. 3) Ask the publisher to clarify the unrelated 'Official docs' Trello link. 4) If you cannot trust Membrane to proxy sensitive data, consider calling the Bridge API directly (with your own credentials) or use a vetted integration. 5) If you proceed, monitor what connections you create and the scope of permissions granted during the browser auth flow.Like a lobster shell, security has layers — review code before you run it.
latestvk97cqvzfhbeg9q72tn672vb40h845cyt
License
MIT-0
Free to use, modify, and redistribute. No attribution required.