ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Anodot

v1.0.0

Anodot integration. Manage data, records, and automate workflows. Use when the user wants to interact with Anodot data.

⭐ 0· 47·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description (Anodot integration) match the SKILL.md content which documents Anodot features and integrations. The skill declares it needs network access and a Membrane account — consistent with a hosted connector that talks to Anodot APIs. There are no unexpected binaries, installs, or config paths declared.
ℹ
Instruction Scope
This is an instruction-only skill (SKILL.md) that references Anodot functionality and requires network + a Membrane account. The file is large but appears to be documentation/usage instructions; there are no code files telling the agent to read arbitrary system files or environment variables. However the SKILL.md does not declare how Anodot credentials are supplied or stored at runtime (it may prompt the user or rely on the Membrane account), which is an ambiguity worth clarifying.
✓
Install Mechanism
No install spec and no code files — lowest-risk form. Nothing is downloaded or written to disk by the skill package itself.
ℹ
Credentials
The skill declares no required env vars or credentials. That's coherent for an instruction-only connector if credentials are supplied interactively or via the Membrane platform. Still, because the skill will need Anodot access at runtime, confirm where and how you must provide API keys/tokens and how Membrane stores/uses them; avoid providing high-privilege long-lived credentials without understanding retention and scope.
✓
Persistence & Privilege
always is false. The skill is user-invocable and can be invoked autonomously (the platform default) — normal for skills. It does not request system-wide config or modify other skills.
Assessment
This skill is an instruction-only Anodot connector that needs network access and a Membrane account to operate. Before installing: (1) Confirm how you will supply Anodot credentials (interactive prompt, Membrane platform storage, or other) and what permissions are required — use least-privilege API keys. (2) Ask the skill/provider how credentials are stored, encrypted, and how long they are retained. (3) If possible, test with a limited-scope or demo Anodot account first. (4) Remember the skill can call network endpoints; if you have sensitive data policies, verify what data the skill will send to external services (Anodot / Membrane). If the vendor or skill listing provides a privacy/security page or source code, review it before granting access.

Like a lobster shell, security has layers — review code before you run it.

latestvk971k8sr57bj3wkj07mp3fjr05848nz3

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments