ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Teamcity

v1.0.0

TeamCity integration. Manage data, records, and automate workflows. Use when the user wants to interact with TeamCity data.

⭐ 0· 25·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The skill claims to integrate with TeamCity and all runtime instructions use the Membrane CLI and Membrane connections to reach TeamCity. Required capabilities (network access and a Membrane account) match the stated purpose; no unrelated services, credentials, or system resources are requested.
✓
Instruction Scope
SKILL.md only instructs installing/using the Membrane CLI, logging in (browser flow or headless completion), creating/listing connections, listing actions, running actions, and proxying requests to TeamCity via Membrane. It does not instruct reading unrelated files or env vars, nor does it ask to exfiltrate data to unexpected endpoints. Note: proxying means requests go through Membrane's servers, so the user must trust that provider for confidentiality of proxied requests.
ℹ
Install Mechanism
There is no automated install spec in the skill bundle; the doc instructs the user to run 'npm install -g @membranehq/cli' (or use npx in examples). Installing a global npm package is a standard, moderate-risk action because npm packages run code on install and at runtime; this is expected for CLI-based integrations but users should verify the package source and prefer npx or a controlled environment if worried.
✓
Credentials
The skill does not require or ask for environment variables, API keys, or local config paths. It explicitly instructs to avoid asking users for API keys and to let Membrane handle credentials server-side, which is proportionate to the integration design.
✓
Persistence & Privilege
The skill is instruction-only, does not request permanent presence (always is false), and does not attempt to modify other skills or system-wide agent settings. Autonomous invocation is enabled by default but that is normal and not a problem here.
Assessment
This skill appears to be what it claims: a TeamCity integration that uses the Membrane CLI as a proxy. Before installing or using it, verify you trust Membrane/getmembrane.com and the npm package @membranehq/cli (review the package page and repository on GitHub). Consider using 'npx @membranehq/cli@latest' instead of a global install to avoid modifying your system, or run the CLI in an isolated environment. Remember that proxied requests will transit Membrane's servers, so avoid sending highly sensitive secrets unless you trust the provider and have checked their privacy/security practices.

Like a lobster shell, security has layers — review code before you run it.

latestvk9731yc576dtsm5qcey2r3nwx5848brm

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments