Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Passslot
v1.0.2PassSlot integration. Manage Organizations. Use when the user wants to interact with PassSlot data.
⭐ 0· 90·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (PassSlot integration) match the SKILL.md: all runtime instructions are about using the Membrane CLI to connect to PassSlot, list/run actions, and proxy API requests. No unrelated services, binaries, or credentials are requested.
Instruction Scope
SKILL.md focuses on discovery and running actions via membrane (connect, connection list, action list, action run, request proxy). It does not instruct reading unrelated files, harvesting environment variables, or sending data to unexpected endpoints. It explicitly advises against asking users for API keys and relies on Membrane for auth.
Install Mechanism
No install spec is embedded in the registry (instruction-only), but the doc instructs users to run `npm install -g @membranehq/cli`. Recommending a global npm install is expected for a CLI but carries typical npm-package risks (supply-chain, privilege of global binaries). Verify the package and publisher (npm page / GitHub repo) before installing.
Credentials
The skill declares no required env vars, no config paths, and no primary credential. It requires a Membrane account (server-side auth) which is proportional to the described functionality; the SKILL.md explicitly discourages collecting user API keys locally.
Persistence & Privilege
Skill is not always-enabled and uses normal autonomous-invocation defaults. It does not request system-wide configuration changes or other skills' credentials. No elevated persistence or privileged behavior is requested.
Assessment
This instruction-only skill appears coherent: it tells the agent to use the Membrane CLI to talk to PassSlot and does not ask for unrelated credentials. Before installing/using: (1) verify the @membranehq/cli package and its GitHub repo to ensure you trust the publisher; (2) be aware `npm install -g` will place binaries on your system—use least-privilege hosts if concerned; (3) confirm the Membrane connector you create points to the legitimate PassSlot integration and avoid pasting secrets into chat; (4) if you run in a headless or CI environment, follow the documented headless login flow carefully and avoid leaking any one-time codes or browser URLs.Like a lobster shell, security has layers — review code before you run it.
latestvk977ed9ryrm0memyzgdq6jtc0d84308v
License
MIT-0
Free to use, modify, and redistribute. No attribution required.