Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Captain Data
v1.0.2Captain Data integration. Manage data, records, and automate workflows. Use when the user wants to interact with Captain Data data.
⭐ 0· 117·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill is described as a Captain Data integration and all runtime instructions use the Membrane CLI to talk to Captain Data — this is coherent. However, the skill metadata declares no required binaries or environment variables while SKILL.md requires installing and running the Membrane CLI (npm -g @membranehq/cli) and a browser-based login flow. The missing declaration of npm/node and a browser requirement is an inconsistency.
Instruction Scope
SKILL.md gives concrete CLI commands for discovery, connecting, running actions, and proxying arbitrary API requests via Membrane. That scope is expected for a proxied integration, but the 'proxy' capability lets the agent send arbitrary requests through Membrane to external endpoints — which is powerful and should be used only when the user intends it. The doc also instructs interactive browser auth and headless code-copy flows; these are normal but require user attention.
Install Mechanism
There is no install spec in the registry (instruction-only), yet the docs instruct running npm install -g @membranehq/cli. Asking an agent or user to run a global npm install is a moderate-risk install path (external package from npm). The absence of a declared install step or required binaries (npm/node) is an implementation mismatch and makes it unclear who/what should perform the install and under what privileges.
Credentials
The skill requests no environment variables or credentials and explicitly tells agents not to ask users for API keys, relying on Membrane to manage auth. This is proportionate for a proxying integration. No unrelated secrets are requested.
Persistence & Privilege
always is false, there are no config paths or declared persistent privileges. The skill does instruct the user/agent to run a CLI that will store tokens via Membrane's own mechanisms, which is expected for this type of integration.
What to consider before installing
This skill appears to do what it says (use Membrane to interact with Captain Data) but note three things before you proceed: (1) SKILL.md expects you to install the Membrane CLI via `npm install -g @membranehq/cli` and perform a browser login — the registry metadata did not declare npm/node as required, so verify you want to install a global npm package and that your environment can support this. (2) The Membrane proxy can run arbitrary requests against APIs on your behalf; only use proxying when you trust the target and the Membrane account. (3) Confirm the @membranehq/cli package and the repository/homepage are legitimate (check the npm page and GitHub repo) before installing. If you want to proceed, perform the CLI install and login manually and review any commands the agent proposes to run; avoid granting the agent uncontrolled ability to run install commands or proxy arbitrary endpoints without explicit user approval.Like a lobster shell, security has layers — review code before you run it.
latestvk97bwtr0p8yh55ks5wbd42k725842jyg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.