Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Schedule It
v1.0.2Schedule it integration. Manage Users, Roles, Organizations, Projects, Pipelines, Activities and more. Use when the user wants to interact with Schedule it d...
⭐ 0· 77·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description claim to integrate with Schedule It and the SKILL.md only instructs use of the Membrane CLI to discover connectors, create connections, run actions, and proxy API requests — all appropriate for a Schedule It integration.
Instruction Scope
Runbook steps are limited to installing/running the Membrane CLI, performing browser-based auth, listing/ running actions, and proxying API calls. The instructions do not ask the agent to read unrelated files, environment variables, or system config.
Install Mechanism
No embedded install script in the skill; the README recommends installing @membranehq/cli via npm or using npx. Using npm is expected for this workflow and does not involve arbitrary downloads or archive extraction.
Credentials
The skill declares no required env vars/credentials. Authentication is handled interactively via Membrane (browser login/connection flow), which is proportionate for an API integration — note that this places trust in Membrane's server-side handling of credentials.
Persistence & Privilege
Skill is instruction-only with no install spec, not always-enabled, and doesn't request system-wide privileges or modify other skills' configs.
Assessment
This skill is coherent: it instructs the agent to use the official Membrane CLI to access Schedule It. Before installing, verify you trust Membrane/@membranehq (homepage and npm package) because your Schedule It connection and credentials will be managed server-side by Membrane. Installing the CLI with npm -g will add a global binary to your system — use npx if you prefer not to install globally. During connection you will complete a browser auth flow that grants Membrane access to your Schedule It data; consider using an account with least privilege and review Membrane's privacy/security docs. Finally, remember the agent can invoke skills autonomously by default — if you are concerned about automated actions against your Schedule It account, restrict when the agent may run this skill.Like a lobster shell, security has layers — review code before you run it.
latestvk972b7jvk0ghxpcpdgh02cwwv18424r8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.