Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Kaleido
v1.0.2Kaleido integration. Manage Organizations. Use when the user wants to interact with Kaleido data.
⭐ 0· 98·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill is advertised as a 'Kaleido integration' and the action table deals with consortia, nodes, environments (Kaleido blockchain), which is consistent with a Kaleido blockchain integration. However, the SKILL.md opening paragraph describes Kaleido as an HTML-to-image/PDF conversion API (a different product/meaning), indicating an authoring error or confusion about the intended target. The homepage and repository references point to Membrane (an integration/CLI platform) rather than Kaleido itself; requiring a Membrane connection is plausible, but the mixed descriptions are incoherent and should be clarified.
Instruction Scope
All runtime instructions are explicit: install @membranehq/cli, run membrane login, create or list Membrane connections, run membrane action run or membrane request (a raw proxy). The instructions do not request local secrets or system files. However, membrane request lets the agent proxy arbitrary paths to the Kaleido API (and Membrane injects auth headers), which is a powerful capability — expected for an integration but useful to be aware of because it can send arbitrary request bodies to external endpoints.
Install Mechanism
There is no platform install spec in the registry (instruction-only), but the SKILL.md tells the user to run 'npm install -g @membranehq/cli' to install the Membrane CLI. Global npm installs are a moderate-risk, out-of-band action (remote package code executed on the machine). The registry did not provide an automated, vetted install step — the user must run the installer themselves.
Credentials
The skill declares no required environment variables or credentials in the registry. The SKILL.md requires a Membrane account and interactive browser-based login; it explicitly advises not to ask users for raw API keys. This is proportionate to the stated Membrane-based integration.
Persistence & Privilege
The skill is instruction-only, has no install script in the registry, and 'always' is false. It does not request persistent system privileges or modify other skills' configs. Autonomous invocation is allowed by default but not combined with other high-privilege requests.
What to consider before installing
This skill mostly tells the agent to use the Membrane CLI to manage a Kaleido integration, which can be legitimate — but there are some red flags: the SKILL.md mixes two different descriptions of 'Kaleido' (HTML-to-image service vs. blockchain consortia), suggesting an authoring mistake or mis-targeted content. Before installing: verify which Kaleido you expect to interact with; confirm you trust Membrane (@membranehq) and the npm package author; be aware you'll need to run a global 'npm install -g' and perform a browser login that grants Membrane access to your Kaleido account. Also note that 'membrane request' can proxy arbitrary API calls (powerful capability) so only use this skill if you trust the Membrane tenant and connection. If the mixed descriptions concern you, ask the publisher for clarification or prefer an officially published, documented connector.Like a lobster shell, security has layers — review code before you run it.
latestvk979nmpdt9s6fdx0k2bn3j5gd58425f6
License
MIT-0
Free to use, modify, and redistribute. No attribution required.