Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Structurizr
v1.0.2Structurizr integration. Manage data, records, and automate workflows. Use when the user wants to interact with Structurizr data.
⭐ 0· 82·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's stated purpose (Structurizr integration) matches the instructions which use Membrane to talk to Structurizr. However the SKILL.md requires installing and running the Membrane CLI (npm-based), while the registry metadata declares no required binaries — a mismatch. It also assumes the user has a Membrane account and network access even though no credentials or env vars are declared.
Instruction Scope
Instructions tell the agent to install and run the Membrane CLI, perform browser-based logins, list/connect Membrane connectors, run actions, and send proxied requests via Membrane. The proxy behavior means request bodies and headers will transit Membrane's servers (not directly to Structurizr). There are no instructions to read local secrets or unrelated files, but the proxying of requests to a third party is a non-trivial data-exposure step that should be explicit and justified to the user.
Install Mechanism
This is an instruction-only skill (no install spec). The SKILL.md instructs installing @membranehq/cli globally via npm, which implies Node/npm presence and permission to install global packages — but required binaries were not declared in the metadata. The absence of an official install spec is not itself malicious, but the metadata/instructions are inconsistent.
Credentials
The skill declares no required environment variables or credentials and explicitly says 'never ask the user for API keys' because Membrane manages auth server-side. That is proportionate for this design, but it means authentication and sensitive tokens live on Membrane's side; users should understand that Membrane will hold or broker access to Structurizr resources.
Persistence & Privilege
The skill does not request always:true or other elevated persistence and is user-invocable. There is no evidence it would attempt to modify other skills or system-wide settings.
What to consider before installing
Before installing, note these points: (1) The skill expects you to install and run the Membrane CLI (npm global install) but the skill metadata does not list required binaries — ensure you have Node/npm and are comfortable installing global packages. (2) Membrane will broker requests and authentication for Structurizr; request/response data (and possibly auth tokens) will transit Membrane's servers — review Membrane's privacy/security practices and only proceed if you trust that provider. (3) If you need stricter control, ask the skill author to: declare required binaries (npm/node), provide an explicit install spec, and document exactly what data is proxied. (4) Prefer running the CLI in a controlled environment (container or ephemeral VM) and avoid global installs on sensitive hosts if you are uncertain.Like a lobster shell, security has layers — review code before you run it.
latestvk97290ncyamvhhf9607aq2mbyh843fp8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.