Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Limacharlie
v1.0.2LimaCharlie integration. Manage data, records, and automate workflows. Use when the user wants to interact with LimaCharlie data.
⭐ 0· 62·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill is named 'Limacharlie' and references LimaCharlie docs, but the SKILL header and homepage/repository point to Membrane (getmembrane.com / membranedev). The compatibility note says a valid Membrane account is required. This is a mismatch: a LimaCharlie integration would reasonably require LimaCharlie credentials or endpoints, not a separate 'Membrane' account. The advertised purpose (manage LimaCharlie data) does not clearly align with the declared dependency on Membrane.
Instruction Scope
This is an instruction-only skill that requires network access and a Membrane account per its header, but the package declares no environment variables or explicit credential inputs. The SKILL.md enumerates many LimaCharlie resource types (sensors, rules, artifacts, etc.), suggesting broad read/write capability. Because there are no declared env vars or install steps, it's unclear how the agent will obtain or store API keys or where it will send data — the instructions may prompt users to paste secrets into chat or call external APIs (Membrane endpoints) without making that explicit.
Install Mechanism
No install spec and no code files are present — the skill is instruction-only. That minimizes disk persistence and arbitrary code installation risk.
Credentials
The header says a 'valid Membrane account' is required, but requires.env and primary credential fields are empty. The skill may therefore request API keys or tokens at runtime (or instruct the agent to ask the user), but it does not declare what secrets it needs. Requesting unspecified credentials (especially for a third-party service that differs from the skill's name) is disproportionate and should be clarified before use.
Persistence & Privilege
always is false and there is no install step that would persist data or modify other skills. The skill does allow autonomous invocation (default), which is expected for skills; this alone is not flagged.
What to consider before installing
Do not paste API keys or other secrets into chat. Before installing or using this skill, ask the author (or the skill manifest) to clarify these points: 1) Which service will the skill call — LimaCharlie (limacharlie.io) or Membrane (getmembrane.com)? 2) Exactly which credentials or tokens are required and how they should be provided (declared env vars, ephemeral auth flow, or user-prompted input)? 3) Which external endpoints will the agent contact and will any data be transmitted to Membrane or other third parties? If the author cannot provide clear answers, treat the skill as untrusted. If you proceed, provide least-privilege, scoped API keys (not full org admin keys) and test in a sandbox account first.Like a lobster shell, security has layers — review code before you run it.
latestvk9718zg3bdrcyxyteapcg2jca58431gc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.