ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Mailbox Power

v1.0.2

Mailbox Power integration. Manage Persons, Organizations, Deals, Pipelines, Activities, Notes and more. Use when the user wants to interact with Mailbox Powe...

⭐ 0· 142·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description (Mailbox Power integration) align with the SKILL.md: it instructs the agent to use the Membrane CLI to list connections, run actions, and proxy requests to Mailbox Power. No unrelated credentials, binaries, or config paths are required.
✓
Instruction Scope
Runtime instructions focus on installing and using the Membrane CLI, performing OAuth-style login, discovering actions, running actions, and proxying API calls. The instructions do not ask the agent to read arbitrary local files, collect unrelated secrets, or transmit data to unexpected endpoints.
ℹ
Install Mechanism
The skill is instruction-only (no install spec), but it tells users to run `npm install -g @membranehq/cli`. This is a reasonable, common approach for CLI-based integrations, but it does mean code will be installed on the host via npm (global install) — verify the npm package and source before installing and consider pinning versions in production.
✓
Credentials
No environment variables, credentials, or config paths are requested by the skill. The instructions explicitly recommend using Membrane connections/OAuth rather than asking users for API keys, which is proportionate to the stated purpose.
✓
Persistence & Privilege
The skill does not request always-on or elevated privileges. It is user-invocable and can be called autonomously by the agent (the platform default), which is expected for a connector skill.
Assessment
This skill appears coherent: it expects you to install and use the @membranehq/cli to manage Mailbox Power through Membrane. Before installing, verify the @membranehq/cli npm package and its GitHub repo (https://github.com/membranedev/application-skills) and that getmembrane.com is the expected vendor. Be aware that `npm install -g` will place binaries on your system; prefer pinning a version in controlled environments. The workflow uses OAuth via a browser (or a headless login flow) so you won't need to paste API keys into the agent. If you have strict security requirements, review Membrane's privacy/auth documentation and confirm you are comfortable delegating credential management to their service.

Like a lobster shell, security has layers — review code before you run it.

latestvk97atcf21rfk7xqs1sq64wh1xx843t7f

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments