Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Wirewheel
v1.0.0WireWheel integration. Manage data, records, and automate workflows. Use when the user wants to interact with WireWheel data.
⭐ 0· 26·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description claim a WireWheel integration (via Membrane). The SKILL.md explicitly says it 'Requires network access and a valid Membrane account', but the skill declares no required credentials, API keys, or config paths. A network-backed integration that manipulates privacy records would normally need credentials or token configuration; the absence of any declared secret is incoherent and unexplained.
Instruction Scope
This is an instruction-only skill (SKILL.md is the runtime instructions). The included fragment lists many WireWheel concepts but does not (in the provided excerpt) declare how the agent authenticates or what endpoints are used. That leaves scope and data access behavior ambiguous — e.g., whether the agent will prompt for credentials, use a third-party proxy (Membrane), or send data to external endpoints. Ambiguous instructions that require network access and account use without declared auth are a red flag.
Install Mechanism
No install spec and no code files are present (instruction-only). This is the lowest install risk: nothing is written to disk by an installer and there are no downloaded/executed packages referenced in the registry metadata.
Credentials
The skill requires a Membrane account according to SKILL.md but lists no environment variables or primary credential. For a connector that manages privacy data, requesting and documenting the minimal required credentials (e.g., MEMBRANE_API_KEY) would be expected. The lack of declared credentials or config paths is disproportionate and leaves open how authentication or secrets are handled.
Persistence & Privilege
always is false and there is no indication the skill requests permanent system presence or modifies other skills' settings. Autonomous invocation is allowed (platform default), but that alone is not a new risk here.
What to consider before installing
This skill's SKILL.md says it needs a Membrane account and network access but the package declares no API key or auth method. Before installing or enabling it: 1) Inspect the full SKILL.md to see exactly how it authenticates and which external endpoints it calls (look for URLs, hosts, or prompts for tokens). 2) Verify the claimed homepage/repository (getmembrane.com and the GitHub repo) and confirm the skill's author and release provenance. 3) Ask the publisher how credentials are provided (environment variables, interactive prompt, or secret manager) and what scopes the token needs; only grant least privilege. 4) Avoid using this skill with sensitive or production WireWheel data until you confirm where data will be sent and how authentication is handled. If the author cannot justify where secrets live or provide clear endpoint/permission details, treat the skill as untrusted.Like a lobster shell, security has layers — review code before you run it.
latestvk9735ehfxbb92wfxasbjx7xea1847kes
License
MIT-0
Free to use, modify, and redistribute. No attribution required.