Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Smartengage
v1.0.0SmartEngage integration. Manage Organizations, Users, Filters. Use when the user wants to interact with SmartEngage data.
⭐ 0· 82·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (SmartEngage integration) match the instructions: all actions are performed via the Membrane CLI and a Membrane account. There are no unrelated credential requests or unrelated binaries asked for.
Instruction Scope
SKILL.md stays on-task: it instructs installing and using the Membrane CLI, creating connections, listing/running actions, and proxying requests. Important note: proxying requests via Membrane sends API calls and data through Membrane’s service (including authentication headers), so the user will be granting Membrane access to their SmartEngage connection and proxied request data. The docs explicitly tell agents not to ask users for API keys, which is appropriate.
Install Mechanism
No install spec in the bundle; the runtime instructions recommend installing @membranehq/cli via npm (global install) or using npx. This is a common approach but carries the usual caveats of executing code from the npm registry and adding a global binary—verify the package name and trustworthiness of @membranehq/cli before installing.
Credentials
The skill declares no required env vars or config paths. Authentication is handled via Membrane/browser OAuth flows as described, which is proportionate to the purpose and avoids asking the user for local secrets.
Persistence & Privilege
The skill is not always-enabled and does not request elevated persistence or modify other skills. It is user-invocable and allows autonomous model invocation (platform default), which is expected for a connector skill.
Assessment
This skill is an instructions-only integration that relies on the Membrane CLI and your Membrane account. Before installing/using it: 1) Verify you trust the @membranehq/cli package (it will be installed from npm and runs code on your machine). 2) Understand that authorizing a SmartEngage connection grants Membrane access to that account and will proxy API requests through Membrane’s servers—review Membrane’s privacy/security docs and the connector’s requested scopes. 3) Do not provide local API keys or secrets to the agent; follow the login/connection browser flow. 4) If you need tighter control, consider using a sandbox account or reviewing the specific actions Membrane will perform before running them. No code files were included in the skill package, so there were no static-scan results to analyze.Like a lobster shell, security has layers — review code before you run it.
latestvk97dyttct02a6927qvxcckp30h83jz78
License
MIT-0
Free to use, modify, and redistribute. No attribution required.