Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Sugarsync
v1.0.0SugarSync integration. Manage data, records, and automate workflows. Use when the user wants to interact with SugarSync data.
⭐ 0· 21·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's stated purpose (SugarSync integration) matches the instructions (use Membrane to proxy to SugarSync). However the SKILL.md expects the Membrane CLI, network access, and a Membrane account while the registry metadata lists no required binaries, credentials, or config paths — a mismatch between declared requirements and real runtime needs.
Instruction Scope
Instructions are focused on interacting with SugarSync through Membrane (login, create connections, run actions, proxy requests). They do not ask the agent to read unrelated files or env vars. However they do instruct installation and execution of CLI commands (npm install -g, membrane login, membrane request) which will perform network operations and can act on user data via the connector.
Install Mechanism
There is no formal install spec for the skill, but the SKILL.md directs users/agents to run 'npm install -g @membranehq/cli' and suggests using 'npx @membranehq/cli@latest'. This is a normal pattern (namespaced package), but global npm installs and running 'npx @latest' have the usual supply-chain risks and will modify the host environment if executed.
Credentials
The skill requests no environment variables or local credentials and explicitly says Membrane handles auth server-side (so no API keys are requested). That is proportionate to the stated purpose. The concern is that the skill's runtime requirements (network access, a Membrane account, a browser for auth or headless flow) are not reflected in the registry metadata.
Persistence & Privilege
The skill is not always-enabled, does not request persistent system-wide changes in its metadata, and is instruction-only. Autonomous model invocation is allowed (default) but is not combined here with other high-risk factors.
What to consider before installing
This skill looks like a straightforward wrapper around the Membrane CLI to access SugarSync, but before installing or running anything: 1) Be aware you need a Membrane account and network access (the registry metadata omits this). 2) The SKILL.md tells you to install a global npm package and/or run npx; verify the @membranehq package and publisher (e.g., check the npm org and GitHub repo) before installing. 3) Prefer running CLI actions in a disposable environment (container/VM) if you're unsure about installing global packages. 4) Understand that the agent (if allowed to run commands) could use the CLI to access or modify your SugarSync data once you authenticate — only grant access to accounts you trust and review the connector permissions during the Membrane OAuth flow. 5) If you want stricter controls, ask the skill author to declare required binaries and the account requirement in registry metadata and to avoid recommending 'npx @latest' for reproducibility.Like a lobster shell, security has layers — review code before you run it.
latestvk975eh3k4zgkzkr3ndjjqfzwwx846zw5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.