Helpwise
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: helpwise Version: 1.0.2 The skill bundle provides instructions for an AI agent to integrate with Helpwise using the Membrane CLI. It follows standard practices for API interaction, specifically delegating credential management to the Membrane platform to avoid handling raw secrets. No malicious code, data exfiltration, or harmful prompt injection patterns were identified in SKILL.md or _meta.json.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If used carelessly, the agent could delete Helpwise conversations, send replies, create or modify records, or call arbitrary Helpwise API endpoints through the authenticated connection.
The skill documents authenticated mutation and deletion actions plus a raw API proxy with multiple HTTP methods, but it does not define confirmation, scoping, or rollback expectations for destructive or customer-facing operations.
Delete Conversation | delete-conversation | Permanently delete a conversation ... membrane request CONNECTION_ID /path/to/endpoint ... HTTP method (GET, POST, PUT, PATCH, DELETE)
Require explicit user approval before replies, deletes, assignments, contact creation, or raw API calls; prefer listed Membrane actions over proxy requests and use the least-privileged Helpwise connection available.
The connected account's Helpwise permissions determine what the agent can read or change.
The skill requires delegated Membrane and Helpwise authentication. This is expected for the integration, but it gives the agent access to actions available through the connected account.
Membrane handles authentication and credentials refresh automatically ... membrane login --tenant ... The user completes authentication in the browser.
Connect only accounts with permissions appropriate for the intended tasks and revoke the connection when it is no longer needed.
Installing the CLI runs third-party package code on the local machine with the user's privileges.
The setup instructs installation of a global npm CLI package without a pinned version. This is purpose-aligned for a Membrane integration, but it relies on npm package provenance and the current published package contents.
npm install -g @membranehq/cli
Verify the package publisher and repository, consider pinning a known-good version, and install only in an environment where running the CLI is acceptable.