Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Clickmeeting
v1.0.2ClickMeeting integration. Manage data, records, and automate workflows. Use when the user wants to interact with ClickMeeting data.
⭐ 0· 92·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (ClickMeeting integration) matches the instructions: all runtime actions are Membrane CLI commands that operate against ClickMeeting. No unrelated credentials, binaries, or system paths are requested.
Instruction Scope
Instructions are focused on installing and using the Membrane CLI and running ClickMeeting actions or proxied requests. Note: the skill documents using Membrane's proxy to send arbitrary ClickMeeting API paths — this is expected for a full integration, but it means the agent (via Membrane) can issue any ClickMeeting API call permitted by the connected account.
Install Mechanism
There is no formal install spec in the registry, but SKILL.md instructs the user to globally install @membranehq/cli via npm. Installing a public npm CLI is a typical approach; it is a moderate-risk action compared with no install because it writes a global binary and pulls code from the npm registry. The instruction uses a well-named package (@membranehq/cli) rather than an arbitrary URL.
Credentials
The skill declares no required environment variables or secrets and relies on Membrane for authentication. That is proportionate: access is framed as performed through the user's Membrane account and browser-based auth.
Persistence & Privilege
The skill is instruction-only, always:false, and does not request permanent presence or modify other skills or system-wide settings. It does not ask to store credentials itself.
Assessment
This skill is coherent and appears to do what it says: it instructs you to install the Membrane CLI and authenticate via your Membrane account to interact with ClickMeeting. Before installing, verify the @membranehq/cli package and the Membrane service are ones you trust (check the package and project repository), and be aware that once connected the CLI/proxy can issue any ClickMeeting API calls your account allows (including create/delete actions). If you prefer minimal risk, consider running the CLI in an isolated environment or test account, and confirm OAuth scopes prompted during login so you understand what access will be granted. If you need more assurance, ask the publisher for a link to the exact CLI repo/release and any permission scopes the ClickMeeting connector requests.Like a lobster shell, security has layers — review code before you run it.
latestvk971zk668qqtccft13yx9h3rcd8439s6
License
MIT-0
Free to use, modify, and redistribute. No attribution required.