Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Ringover
v1.0.2Ringover integration. Manage Persons, Organizations, Deals, Leads, Activities, Notes and more. Use when the user wants to interact with Ringover data.
⭐ 0· 86·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's stated purpose (Ringover integration) matches the instructions which use Membrane as a proxy to Ringover. However, the skill metadata lists no required binaries or install steps while the SKILL.md explicitly requires installing the @membranehq/cli npm package and using the 'membrane' binary. That omission is an inconsistency (likely sloppy metadata) but not necessarily malicious.
Instruction Scope
SKILL.md confines runtime actions to installing/using the Membrane CLI, performing a browser-based login, creating/listing connections, running actions, and proxying requests to Ringover. It does not instruct reading unrelated files or exfiltrating secrets and explicitly advises not to ask users for API keys.
Install Mechanism
There is no install spec in the registry entry, yet the instructions require running 'npm install -g @membranehq/cli'. Global npm installs execute third-party code and write binaries to disk — a moderate-risk install pattern. The skill should either declare this requirement in metadata or provide a vetted install spec; absence of that declaration is a red flag for supply-chain risk.
Credentials
The skill does not request environment variables or credentials directly; it relies on Membrane to manage auth. That is proportionate for a proxy-style integration. The only external requirement is a Membrane account (documented in SKILL.md).
Persistence & Privilege
The skill does not request always-on presence or attempt to modify other skills or system-wide settings. It recommends installing a global CLI, which persists a binary on the system, but the skill itself does not demand elevated platform privileges.
What to consider before installing
This skill appears to do what it says (use Membrane to access Ringover) but there's an important metadata mismatch: the SKILL.md requires installing the @membranehq/cli npm package and using the 'membrane' binary, yet the registry entry declares no required binaries or install steps. Before installing or running these commands, verify the upstream package and service: (1) review the @membranehq/cli package on the npm registry and its source repo (ensure the maintainer and code look trustworthy); (2) confirm getmembrane.com and the Membrane project are the intended providers; (3) prefer installing the CLI in an isolated environment (container or VM) if you want to limit supply-chain risk; (4) be cautious about running global npm installs on production machines — they execute arbitrary code; (5) ask the skill author or registry maintainer to update the skill metadata to declare the 'membrane' binary requirement (or provide an install spec). If those checks look good and you accept the npm-install risk, the skill's behavior is coherent with its purpose.Like a lobster shell, security has layers — review code before you run it.
latestvk9716rpsjpkbtkz2jrvhwe9cj9843mmq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.