Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Sms Magic
v1.0.2SMS Magic integration. Manage SMSes, Contacts, Conversations, Templates, Campaigns, Lists. Use when the user wants to interact with SMS Magic data.
⭐ 0· 113·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name and description (SMS Magic integration) line up with the runtime instructions: discovering connectors, creating connections, running actions, and proxying API requests via the Membrane CLI. No unrelated credentials, binaries, or config paths are required.
Instruction Scope
The SKILL.md stays within the stated purpose: it instructs installing and using the Membrane CLI to list actions, create connections, run actions, and proxy API requests to SMS Magic. One notable capability: the proxy feature lets you send arbitrary requests to SMS Magic endpoints through Membrane, which is expected for an integration but means the CLI/service will be able to perform arbitrary API calls once connected.
Install Mechanism
Installation is a global npm package: `npm install -g @membranehq/cli` (and/or npx usage). This is a standard distribution channel, not an ad-hoc URL download; however, installing a global npm CLI runs third-party code on your machine and requires trust in the package and publisher.
Credentials
The skill declares no environment variables or credentials and explicitly advises against asking users for API keys, instead relying on Membrane for auth. This is proportionate for the stated goal; it does require trusting Membrane to manage credentials server-side.
Persistence & Privilege
No special persistence requested (always: false). The skill is instruction-only and does not modify other skills or system-wide agent settings. Autonomous invocation is allowed by default but is not combined with elevated privileges or broad credential requirements.
Assessment
This skill is coherent for integrating with SMS Magic via Membrane, but before installing and using it you should: (1) verify the NPM package name and publisher (@membranehq) and inspect the package (or its GitHub repo) if you can; (2) be aware that installing a global CLI executes third-party code on your machine—avoid installing as root or in sensitive environments; (3) understand that Membrane will store and use your SMS Magic credentials server-side and the proxy feature allows arbitrary API calls through that connection, so only connect accounts you trust and monitor what actions are performed; (4) prefer using npx where possible for one-off runs; and (5) if you need stricter isolation, run the CLI in a sandboxed environment or inspect the calls it will make before granting access.Like a lobster shell, security has layers — review code before you run it.
latestvk97eav1jwjfes4vwejzwn888bn842z3e
License
MIT-0
Free to use, modify, and redistribute. No attribution required.