Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Onelogin
v1.0.0OneLogin integration. Manage data, records, and automate workflows. Use when the user wants to interact with OneLogin data.
⭐ 0· 28·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md's behavior matches a OneLogin integration (using Membrane to connect, list actions, run actions, and proxy OneLogin API calls). However the skill registry metadata declares no required binaries, environment variables, or account requirements while the instructions clearly require network access, a Membrane account, and installation (or invocation) of the @membranehq/cli. This metadata mismatch is a coherence issue (likely sloppy metadata) but not itself evidence of malice.
Instruction Scope
The runtime instructions are scoped to interacting with OneLogin via the Membrane CLI and its proxy. They do not instruct reading unrelated local files or environment variables, nor do they ask the user to provide raw OneLogin API keys. Note: using Membrane routes requests and OneLogin credentials through Membrane's service (server-side); that is expected for this integration but is an important privacy/security consideration.
Install Mechanism
Installation is instruction-only and asks the user to install the @membranehq/cli via npm (global) or use npx. npm packages are a moderate-risk install source but are common for CLIs. The SKILL.md mixes npm -g and npx guidance and there is no install spec in the registry metadata — this inconsistency should be fixed. No downloads from untrusted URLs are present.
Credentials
The skill does not request any environment variables in metadata and the docs explicitly say not to ask users for API keys (Membrane handles auth). That is proportionate. However, the registry metadata fails to declare that a Membrane account and network access are required, which is an omission that reduces transparency.
Persistence & Privilege
The skill does not request always:true and does not claim system-wide persistence or modification of other skills' configs. Autonomous model invocation remains allowed (platform default) but is not combined with elevated privileges here.
What to consider before installing
This skill appears to be a legitimate OneLogin integration that relies on the third-party Membrane service and its CLI. Before installing or using it: (1) verify you trust Membrane (getmembrane.com) and review its privacy/security docs because OneLogin credentials and API requests will be proxied through Membrane; (2) be aware you'll need a Membrane account and to install or run @membranehq/cli (the registry metadata does not declare this requirement — treat that as a metadata bug); (3) prefer using npx if you don't want a global npm install, and inspect what the CLI does before installing it globally; (4) confirm the skill’s source/owner (repository and owner ID) and prefer skills with a known, verifiable origin; (5) if you require stricter control, avoid granting this skill autonomous invocation until you can audit its behavior and Membrane’s handling of your data.Like a lobster shell, security has layers — review code before you run it.
latestvk97ab1jgpmk3qx67ttj05y9ywn846qsm
License
MIT-0
Free to use, modify, and redistribute. No attribution required.