Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Rev
v1.0.2Rev integration. Manage Organizations, Users, Goals, Filters. Use when the user wants to interact with Rev data.
⭐ 0· 106·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to be a Rev integration and the SKILL.md describes using Membrane to call Rev APIs, which is consistent. However the top-line description lists entities like "Organizations, Users, Goals, Filters" (especially "Goals") that don't clearly match Rev's core transcription/captioning purpose; this could be sloppy metadata or a mild mislabeling.
Instruction Scope
All runtime instructions are limited to installing and using the @membranehq/cli and invoking membrane commands (login, connect, action run, request). The instructions do not ask the agent to read local files, arbitrary env vars, or modify unrelated system state. They do, however, instruct the user/agent to send requests through Membrane (i.e., user data will be proxied to Membrane and Rev).
Install Mechanism
This is an instruction-only skill (no install spec in registry), but the SKILL.md tells users to run `npm install -g @membranehq/cli`. Installing a global npm package is a moderate-risk action (it writes to disk and may run code). The package itself is from a public npm namespace (@membranehq) which is expected, but the registry metadata does not include an automated install spec — the install step is manual and should be reviewed before running.
Credentials
The skill requests no environment variables or local credentials. It relies on Membrane's browser-based login/connection flow and claims to manage credentials server-side. This is proportionate to the stated purpose, but it means requests and credentials are handled by Membrane (verify you trust that service).
Persistence & Privilege
The skill does not request always: true and does not declare persistent system-wide changes. It requires network access and an authenticated Membrane account to operate, which is normal for a connector.
What to consider before installing
Before installing: 1) Verify you trust Membrane (getmembrane.com/@membranehq) because the CLI and the instructions will proxy data and credentials through their service to Rev. 2) Inspect the @membranehq/cli package (npm page and GitHub repo) before running `npm install -g` — prefer using `npx` or a local install if you want to avoid a global package. 3) Confirm the mismatch in the description ("Goals, Filters") is intentional and that the skill actually targets the Rev APIs you expect. 4) Understand that any data you send via `membrane request` or actions will go to Membrane and onward to Rev; if that is sensitive, review Membrane's privacy/security docs or avoid using the proxy. If you want more assurance, ask the skill author or inspect the Membrane CLI source and the repository referenced in the SKILL.md.Like a lobster shell, security has layers — review code before you run it.
latestvk970en0xzj46c1yk39pgawv57d842n41
License
MIT-0
Free to use, modify, and redistribute. No attribution required.