Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Icepay
v1.0.0ICEPAY integration. Manage data, records, and automate workflows. Use when the user wants to interact with ICEPAY data.
⭐ 0· 52·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
The name/description match the instructions: the SKILL.md directs the agent to use the Membrane CLI to interact with ICEPAY (connectors, actions, and proxy requests). All required capabilities (network access, Membrane account) are proportional to the stated purpose.
Instruction Scope
Instructions stay within the ICEPAY integration scope (login via Membrane, create connections, list/run actions, proxy requests). They do not instruct reading unrelated files or environment variables. Note: the doc tells the user to install and run a third-party CLI and to perform login flows that will open a browser (or return a code for headless flows). Also the agent could run actions that change payment data—so operational safeguards are advisable.
Install Mechanism
There is no automatic install spec in the registry; the SKILL.md instructs users to run `npm install -g @membranehq/cli` or use `npx`. This is a standard way to get a CLI but carries normal npm risks (network download, global write). Because installation is manual/user-invoked and from npm, risk is moderate but expected for a CLI-based integration.
Credentials
The skill declares no required environment variables or credentials. It explicitly delegates credential management to Membrane, which is sensible for this integration. The main proportionality note is that using Membrane means authentication/requests/possibly payment data will transit Membrane's servers — this is expected but worth understanding from a privacy/security perspective.
Persistence & Privilege
The skill is instruction-only and does not request always:true or any elevated persistent privilege. It will not modify other skills or platform settings. The only persistence users may introduce is by installing the Membrane CLI themselves.
Assessment
This skill appears coherent and does what it claims: it tells you to use the Membrane CLI as a proxy to interact with ICEPAY. Before installing or using it: (1) Verify you trust Membrane (https://getmembrane.com) and review their privacy/security and PCI handling for payment data, because requests and credentials are proxied through their service. (2) Prefer using `npx @membranehq/cli@latest` instead of a global `npm -g` install to avoid altering your system PATH, or inspect the package on the npm registry/GitHub before installing. (3) Use a non-production/test account when first exercising actions that modify payments or merchant state. (4) If you want to limit risk from autonomous agent activity, restrict or monitor the agent's ability to invoke the skill (audit connection IDs and action runs). (5) Confirm the package name and repository ownership on npm/GitHub to avoid typosquatting. These steps will reduce risk while allowing you to use the integration.Like a lobster shell, security has layers — review code before you run it.
latestvk9780qaw4mtapfyb47b51j9xgx84d6ey
License
MIT-0
Free to use, modify, and redistribute. No attribution required.