Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Griffin
v1.0.0Griffin integration. Manage data, records, and automate workflows. Use when the user wants to interact with Griffin data.
⭐ 0· 48·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name/description (Griffin integration) aligns with the runtime instructions: all actions are performed via the Membrane CLI or Membrane proxy to Griffin. However, the registry metadata claims no required binaries or install, while the SKILL.md explicitly instructs installing the @membranehq/cli (global npm install) and using the membrane binary. That omission is inconsistent with the stated requirements.
Instruction Scope
The instructions stay within the skill's purpose: discover actions, run actions, and proxy requests to Griffin via the Membrane CLI. They do not instruct reading unrelated files or exporting arbitrary environment variables. They do, however, rely on browser-based auth or headless login flows and clearly state that Membrane handles credentials (so secrets are not handled locally).
Install Mechanism
There is no formal install spec in the registry, yet SKILL.md instructs 'npm install -g @membranehq/cli' and also shows npx usage. Global npm installs modify the host system and require npm/node to be present; this is not declared. The guidance to install a package from the npm registry is not inherently malicious, but the registry should have declared required binaries and/or an install spec so users can understand impact and provenance before running commands.
Credentials
The skill does not request any environment variables or local secrets and explicitly advises using Membrane-managed connections rather than asking for API keys. It does require a Membrane account and network access (noted in SKILL.md), which is proportionate to the described functionality.
Persistence & Privilege
The skill is not marked always:true and does not request elevated or persistent platform privileges. The only persistent effect recommended by the doc is installing the Membrane CLI on the host (a local change), which is normal for a CLI-based integration but should be made explicit in metadata.
What to consider before installing
This skill appears to do what it says (use Membrane to operate on Griffin), but the README-like instructions require installing a global npm package and running a CLI that are not declared in the skill metadata. Before installing or running anything: 1) Verify the @membranehq/cli package and its source (check the npm page and the repository linked on getmembrane.com/GitHub) and prefer using npx for one-off operations instead of a global install. 2) Recognize that using 'membrane request' proxies requests through Membrane servers — confirm you are comfortable with that provider seeing/requesting your Griff in data and that their privacy/security posture meets your requirements. 3) Ensure Node/npm are present in the environment and avoid running global installs on sensitive or production hosts until the package provenance is verified. 4) Ask the skill author (or registry owner) to update the skill metadata to declare required binaries (node, npm, membrane) and an explicit install spec so the runtime expectations are clear.Like a lobster shell, security has layers — review code before you run it.
latestvk970n92m992wem6zxfqxfktwgs848s9m
License
MIT-0
Free to use, modify, and redistribute. No attribution required.