Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Yuki
v1.0.2Yuki integration. Manage data, records, and automate workflows. Use when the user wants to interact with Yuki data.
⭐ 0· 86·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name/description (Yuki integration) aligns with the runtime instructions: all actions are routed through the Membrane CLI to talk to Yuki. However, the declared requirements list no required binaries or primary credential even though the SKILL.md explicitly requires the 'membrane' CLI and a Membrane account; that's an omission in the manifest.
Instruction Scope
SKILL.md confines the agent to using Membrane to discover connectors, create connections, run actions, and proxy requests to the Yuki API. It does not instruct reading arbitrary local files or exfiltrating data to unexpected endpoints; all remote calls are via Membrane.
Install Mechanism
There is no install spec in the registry metadata, but the instructions ask the user to run 'npm install -g @membranehq/cli' (global npm install). Asking users to install a global npm package is reasonable for this integration but should be called out in the metadata; installing packages globally carries the usual supply-chain risks and should be verified (package source, publisher, version).
Credentials
The skill requests no environment variables or local config paths and explicitly instructs not to ask users for API keys (Membrane handles auth). That is proportionate: auth is delegated to Membrane rather than requiring unrelated secrets.
Persistence & Privilege
The skill is not forced-always, has no special system persistence, and does not request modifying other skills or system-wide settings. Autonomous invocation remains enabled (platform default) but is not combined with other high-risk flags.
What to consider before installing
This skill appears to do what it says (use Membrane to talk to Yuki) but the manifest omits the obvious dependency on the 'membrane' CLI. Before installing or running commands: 1) verify the @membranehq/cli package and publisher on npm (avoid untrusted or typosquatted packages), 2) consider installing the CLI in a controlled environment (container or VM) if you have supply-chain concerns, 3) ensure you trust the Membrane service and its privacy/credential handling since authentication is delegated to it, and 4) confirm you are comfortable running global npm installs — or use npx/local install if you prefer not to install globally.Like a lobster shell, security has layers — review code before you run it.
latestvk977mswqdt3qy9ngc33vxhqpcd842fwx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.