Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Cludo
v1.0.0Cludo integration. Manage data, records, and automate workflows. Use when the user wants to interact with Cludo data.
⭐ 0· 51·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (Cludo integration) matches the instructions: all runtime steps call the Membrane CLI to discover connectors, create a connection, run actions, or proxy requests to the Cludo API. The skill does not request unrelated env vars, binaries, or config paths.
Instruction Scope
SKILL.md instructs installing and running the Membrane CLI, performing web-based login, creating connections, and proxying requests via Membrane. These actions are within scope for a Cludo integration, but they entail sending requests through Membrane's service (including auth headers and proxied payloads), which is expected but worth noting.
Install Mechanism
There is no install spec in the registry (instruction-only). The README recommends installing @membranehq/cli via npm -g (a public npm package). This is a typical approach but requires trusting the published CLI package and introduces the usual risks of global npm installs (e.g., elevated permissions, supply-chain risk).
Credentials
The skill declares no required environment variables or credentials. All credential handling is delegated to Membrane (server-side), which is coherent with the claimed behavior. No unrelated secrets or config paths are requested.
Persistence & Privilege
Skill is not always-enabled, is user-invocable, and does not request elevated platform privileges or modify other skills or system-wide configuration. Autonomous invocation is allowed (platform default) but not excessive here.
Assessment
This skill is coherent but relies on the third-party Membrane CLI and service to handle authentication and to proxy requests to Cludo. Before installing or following the SKILL.md steps: (1) verify the @membranehq/cli package and its publisher (review the npm package page and source repo), (2) prefer npx or using a local install if you want to avoid a global npm -g install, (3) be aware that any proxied requests and auth headers will pass through Membrane’s servers—do not send data you would not permit Membrane to see, and (4) perform initial testing in an isolated environment or with a least-privilege Membrane/Cludo account if you are unsure. If you cannot trust Membrane or its CLI, do not proceed.Like a lobster shell, security has layers — review code before you run it.
latestvk97by4ftscwbpd6k5q2vdx8jbh84c612
License
MIT-0
Free to use, modify, and redistribute. No attribution required.