Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Beacon
v1.0.0Beacon integration. Manage data, records, and automate workflows. Use when the user wants to interact with Beacon data.
⭐ 0· 88·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md describes a Beacon integration using Membrane and provides commands to connect and proxy requests; that aligns with the skill name/description. However, the manifest lists no required binaries while the instructions require npm/node to install the Membrane CLI. Also the 'Official docs' link in the SKILL.md points at an Estimote/Beacon hardware tutorial that appears unrelated to the described cloud/service integration, which suggests sloppy or copied documentation.
Instruction Scope
All runtime instructions are scoped to installing and using the @membranehq/cli to create connections, list actions, run actions, and proxy raw requests. The skill does not instruct the agent to read local config files or environment variables or to exfiltrate unrelated data. It does instruct the agent to open a browser for login (or use a headless flow) and to run globally-installed CLI commands.
Install Mechanism
There is no formal install spec in the registry, but SKILL.md tells the user to run 'npm install -g @membranehq/cli'. That installs an external npm package globally (writes to disk and adds a persistent binary). Using npm is a standard mechanism, but the registry metadata failing to declare Node/npm as a required binary is an inconsistency the user should notice. Installing global npm packages modifies the host and runs third-party code from the npm registry—verify the package source before installing.
Credentials
The skill declares no required environment variables or credentials and explicitly says Membrane manages auth server-side, so it does not request local API keys. This is proportionate to the described purpose. Note that using Membrane delegates authentication and request proxying to Membrane's servers (i.e., Membrane will hold/handle credentials and perform requests on your behalf).
Persistence & Privilege
The skill does not request 'always: true' and does not itself declare persistence. However, following the instructions will install a persistent global CLI binary on the system. Also the skill can be invoked autonomously (default), which combined with a globally installed CLI could let an agent run membrane commands without additional installs—this is expected behavior but worth noting.
What to consider before installing
This skill appears to be what it claims (a Beacon integration via Membrane) but has a few issues you should consider before installing: (1) The instructions require Node/npm to install a global CLI but the registry metadata does not declare that requirement—ensure you have a secure environment for installing global npm packages. (2) Verify the npm package @membranehq/cli on the npm registry/GitHub (maintainer identity, star count, recent releases, and source) before running a global install because that code will run on your machine. (3) The SKILL.md's 'official docs' link looks unrelated — this may be sloppy documentation; confirm the target Beacon service and endpoints you expect Membrane to access. (4) Using Membrane means you delegate auth and proxying to Membrane's service; if you need strict data residency or control over credentials, confirm their policies. If any of these are unacceptable, do not install the CLI or run the skill; to improve confidence, ask the skill author for (a) an explicit requirement for Node/npm in the manifest, (b) confirmation of the correct Beacon docs/service, and (c) the exact npm package source (GitHub repo & release) to review before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk971kf46b4n1gs8zsevawvz21s84h253
License
MIT-0
Free to use, modify, and redistribute. No attribution required.