Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Everwebinar
v1.0.0EverWebinar integration. Manage data, records, and automate workflows. Use when the user wants to interact with EverWebinar data.
⭐ 0· 27·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to integrate with EverWebinar and its runtime instructions use the Membrane CLI to discover and run EverWebinar actions — this is coherent. However, the registry metadata lists no required binaries/env while the SKILL.md clearly requires the 'membrane' CLI (and npm/npx to install it). The missing declaration is an inconsistency.
Instruction Scope
SKILL.md stays on-task: it instructs installing and using the Membrane CLI, logging in, creating connections, listing and running actions, and optionally proxying raw EverWebinar API requests via Membrane. It does not instruct reading unrelated system files or environment variables.
Install Mechanism
There is no formal install spec in the registry, but SKILL.md directs users to run 'npm install -g @membranehq/cli' (and recommends npx for some commands). Installing a package from the npm registry is a common choice but has moderate risk (global npm install runs package install scripts). The SKILL.md uses public npm (no arbitrary URLs), which is expected but should be verified (publisher, package name).
Credentials
The skill does not request env vars or secrets in metadata and explicitly advises not to ask users for API keys; authentication is handled by Membrane. That is proportionate to the described functionality. Note that using Membrane means EverWebinar credentials and proxied requests will be handled by a third-party service.
Persistence & Privilege
The skill is not always-on and does not request elevated agent privileges or modifications to other skills. Autonomous invocation is allowed (platform default). Nothing in the SKILL.md asks to persist configuration outside normal Membrane connection creation.
What to consider before installing
Before installing: (1) Understand that this skill relies on the third-party Membrane service and its CLI — your EverWebinar data and API calls will be proxied through Membrane; verify you trust that provider and review their privacy/security docs. (2) The registry metadata did not declare required tools: you will need Node/npm (for npm/npx) and the 'membrane' CLI (installed globally or used via npx). (3) Global 'npm install -g' runs package install scripts — check the @membranehq/cli package maintainer and prefer running in an isolated environment (container/VM) if you are cautious. (4) If you need stronger assurance, ask the publisher for an install spec or a signed release and confirm the homepage/repository are legitimate before proceeding.Like a lobster shell, security has layers — review code before you run it.
latestvk978h58n60j7qq79eeb89v278n848hya
License
MIT-0
Free to use, modify, and redistribute. No attribution required.