ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Landbot

v1.0.2

Landbot integration. Manage Leads, Persons, Organizations, Deals, Pipelines, Activities and more. Use when the user wants to interact with Landbot data.

⭐ 0· 146·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description (Landbot integration) aligns with the runtime instructions, which show how to connect to Landbot via the Membrane CLI and run Landbot-related actions. No unrelated credentials, binaries, or paths are requested.
✓
Instruction Scope
SKILL.md only instructs installing and using the Membrane CLI (login, create connection, list/run actions, proxy requests). It does not instruct reading unrelated files or environment variables, nor does it ask the agent to collect or transmit data beyond interacting with Landbot via Membrane.
ℹ
Install Mechanism
The skill is instruction-only and recommends installing @membranehq/cli via npm -g (public npm). This is a reasonable, common mechanism but carries typical risks of installing global npm packages (privilege use, supply-chain trust). The skill itself does not auto-download or execute code.
✓
Credentials
No environment variables or local credentials are required by the skill. Authentication is delegated to Membrane (server-side), which is consistent with the guidance not to ask users for API keys. Users should understand that Membrane will hold and manage the Landbot credentials.
ℹ
Persistence & Privilege
always:false (no forced presence). The skill permits normal autonomous invocation (platform default). This is expected, but users should be aware that once the agent is authorized via Membrane login, the agent (if authorized to invoke the skill) could perform actions in the user's Landbot account through Membrane.
Assessment
This skill is coherent: it tells the agent to use the Membrane CLI to talk to Landbot and does not request local secrets. Before installing, confirm you trust Membrane (https://getmembrane.com) because it will store/manage your Landbot credentials and the CLI will be able to run actions on your behalf. Installing the CLI requires npm -g (global install) which may need elevated privileges—use your normal package-security practices (verify package source, prefer scoped/local installs if appropriate). Finally, be mindful of allowing autonomous agent actions: if the agent can invoke the skill, it could make changes in your Landbot account via Membrane once you log in.

Like a lobster shell, security has layers — review code before you run it.

latestvk971b0ajvtvgee4866vzvk0rk18427qr

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments