Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Snapshot
v1.0.2SnapShot integration. Manage data, records, and automate workflows. Use when the user wants to interact with SnapShot data.
⭐ 0· 65·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description match the instructions: the skill is an integration that uses the Membrane CLI to interact with SnapShot. However, the SKILL.md contains a likely copy/paste error (references 'Official docs: https://developer.snapkit.com/' which is SnapKit, not clearly related to 'SnapShot') and the registry metadata does not declare that the Membrane CLI (or npm/node) is required even though the runtime instructions instruct the user to install @membranehq/cli.
Instruction Scope
Instructions are limited to installing and using the Membrane CLI, creating connections, listing actions, running actions, and proxying requests. The skill does not instruct the agent to read unrelated local files, environment variables, or to exfiltrate data. It does rely on browser-based authentication via the CLI.
Install Mechanism
There is no platform install spec (skill is instruction-only). The SKILL.md tells users to run `npm install -g @membranehq/cli` (or use npx in some examples). Installing a global npm package is a common but non-zero risk; the package is on the public npm registry and appears traceable, but the skill metadata should have declared required binaries (node/npm) and the expected CLI.
Credentials
The skill declares no required environment variables and the instructions explicitly say Membrane manages credentials server-side, so it does not ask for API keys or other secrets. That request set is proportionate to the stated purpose (it does require a Membrane account and network access).
Persistence & Privilege
The skill is not always-enabled and does not request elevated persistence. It is user-invocable and allows normal autonomous invocation (platform default). There is no instruction to modify other skills or system-wide agent settings.
What to consider before installing
This skill appears to be an instruction-only integration that uses the Membrane CLI to interact with SnapShot; nothing in the instructions asks for API keys or to read arbitrary files. Before installing/using it: 1) verify the CLI package (@membranehq/cli) on the npm registry and prefer running with `npx` if you don't want a global install; 2) confirm the Membrane project's homepage and docs (the SKILL.md's 'SnapKit' link looks incorrect) to ensure you're following official instructions; 3) be prepared to authenticate via a browser (Membrane login opens a browser or prints a URL for headless flows); and 4) if you have low tolerance for third-party CLIs, review the CLI's source on GitHub and npm package contents before installing. If anything else in the skill metadata (owner, repo, homepage) looks unfamiliar, do not install until you verify the publisher and package provenance.Like a lobster shell, security has layers — review code before you run it.
latestvk9792sg59zrz276es6by1vkc31842gkt
License
MIT-0
Free to use, modify, and redistribute. No attribution required.