Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Successware21
v1.0.0SuccessWare21 integration. Manage data, records, and automate workflows. Use when the user wants to interact with SuccessWare21 data.
⭐ 0· 46·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description align with the instructions: it uses the Membrane CLI to access SuccessWare21. One minor mismatch: the SKILL.md instructs installing the Membrane CLI via npm and requires network access, but the registry metadata lists no required binaries or network requirement. Expect to need npm (or npx) and network access to use the skill.
Instruction Scope
SKILL.md confines runtime actions to installing/using the @membranehq/cli, creating connections, listing/running actions, and proxying requests through Membrane. It does not instruct reading unrelated local files or other system credentials. The proxy capability allows arbitrary SuccessWare21 API requests via Membrane — this is expected for the integration but means commands can send any data you pass to the external API.
Install Mechanism
There is no formal install spec in the registry; the README directs users to install a global npm package (npm install -g @membranehq/cli) or use npx. Installing a public npm CLI is a normal path but is a moderate-risk action compared with instruction-only skills: it will write binaries to disk and requires npm/network. The package appears to be from the @membranehq namespace, which is consistent with the homepage, but the registry metadata did not declare this dependency.
Credentials
The skill declares no required env vars or credentials and explicitly instructs to avoid asking users for API keys because Membrane manages auth server-side. This is proportionate to the stated purpose. Membrane will handle authentication in the browser flow and store credentials on its side; users should understand that the Membrane service will be able to access the SuccessWare21 account once connected.
Persistence & Privilege
The skill does not request always:true and is user-invocable; model invocation is allowed by default (normal). It does not ask to modify other skills or system-wide config. Autonomous invocation combined with these instructions is not a special concern here.
Assessment
This appears to be a straightforward integration that uses the Membrane CLI to access SuccessWare21. Before installing or using it: 1) Confirm you trust the Membrane service (getmembrane.com/@membranehq) because it will hold/proxy your SuccessWare21 credentials and can see requests/data sent through it. 2) Be prepared to install a global npm CLI (or use npx) and to open a browser for interactive login — the registry metadata did not declare npm as a required binary. 3) Review the @membranehq/cli package and its repository (verify publisher, package version, and permissions) before running npm install -g. 4) When running proxy or action requests, avoid sending unrelated sensitive data; Membrane will forward whatever you pass to the external API. If you want stricter guarantees, ask for the Membrane privacy/security docs or an official integration manifest before proceeding.Like a lobster shell, security has layers — review code before you run it.
latestvk97c8ttx7vbcwm714ns8stdkbn848dwg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.