Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Temenos T24 Transact
v1.0.0Temenos T24 Transact integration. Manage data, records, and automate workflows. Use when the user wants to interact with Temenos T24 Transact data.
⭐ 0· 52·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
medium confidencePurpose & Capability
The skill claims to integrate with Temenos T24 and the runtime instructions consistently use Membrane as a connector/proxy to do that — this is coherent. However, the skill metadata declares no required binaries or credentials while SKILL.md instructs installing and using the Membrane CLI (npm/@membranehq/cli) and running membrane login; the missing declaration is a mismatch (sloppy but not necessarily malicious).
Instruction Scope
SKILL.md stays on-topic: it only describes installing the Membrane CLI, creating connections, listing actions, running actions, and proxying requests to the Temenos API. It does not instruct reading unrelated system files or exfiltrating data to third-party endpoints beyond Membrane, nor does it request arbitrary environment variables.
Install Mechanism
There is no formal install spec in the registry metadata (skill is instruction-only) but SKILL.md tells users to run `npm install -g @membranehq/cli` and uses `npx` in examples. Installing a global npm package is a moderate-risk operation (writes to the system, executes code from the npm registry). This is expected for a CLI-based integration but the skill should have declared those requirements.
Credentials
The skill does not request environment variables or other credentials in the metadata. Authentication is intended to be handled by Membrane (the user runs `membrane login`). That is proportional to the described purpose. Note: SKILL.md omits details about where Membrane stores tokens/config on disk, which may matter for sensitive environments.
Persistence & Privilege
The skill is not force-enabled (always:false). It can be invoked autonomously by the agent (default), which is normal for skills. If the agent has shell access and a logged-in Membrane CLI, it could execute the same commands autonomously — consider that when enabling autonomous behavior.
Assessment
What to check before installing: 1) Confirm the Membrane CLI package (@membranehq/cli) is the legitimate package on npm and review its repository (the SKILL.md references https://github.com/membranedev/application-skills and https://getmembrane.com). 2) Installing with `npm -g` modifies your system — prefer `npx` or local installs if you want to avoid global changes, or audit the package first. 3) The skill relies on a Membrane account and `membrane login` (browser-based auth); verify how and where the CLI stores tokens/config on your machine if that matters. 4) The registry metadata does not declare required binaries (node/npm/membrane) — that mismatch is likely an oversight but verify prerequisites before running commands. 5) If you do not want agents to run CLI commands automatically, restrict autonomous invocation or review agent permissions. If you want increased assurance, ask the publisher for explicit required-binaries and an install spec or inspect the Membrane CLI source before proceeding.Like a lobster shell, security has layers — review code before you run it.
latestvk973d6rbnztvwd1sd30pgtn04h84dt3y
License
MIT-0
Free to use, modify, and redistribute. No attribution required.