Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Fastly
v1.0.0Fastly integration. Manage data, records, and automate workflows. Use when the user wants to interact with Fastly data.
⭐ 0· 24·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md clearly documents a Fastly integration implemented by calling the Membrane CLI and Membrane proxy. That matches the stated purpose. However, the registry metadata claims no required binaries/configs, while the runtime instructions require the `membrane` CLI (npm package). This metadata mismatch reduces transparency and is worth flagging.
Instruction Scope
Instructions are scoped to installing/using the Membrane CLI, creating a connection, running pre-built actions, and optionally proxying arbitrary Fastly API requests via `membrane request`. All of that is within the stated purpose. Important operational detail: proxying sends request paths and bodies through Membrane's servers (they inject auth); any data you send to Fastly via this skill will transit through and be visible to Membrane, so you must trust that service and its data-handling policies.
Install Mechanism
There is no formal install spec, but SKILL.md instructs `npm install -g @membranehq/cli` or using `npx`. Installing a global npm package is a common but non-trivial action (writes to the system PATH). This is moderate-risk compared to instruction-only skills because it pulls code from the public npm registry; verify the package and its publisher before installing. The absence of an install entry in the registry metadata is an inconsistency.
Credentials
The skill declares no required environment variables, which matches the approach of delegating authentication to Membrane. That is proportionate. However, delegating auth means Membrane will store/handle Fastly credentials and perform requests on your behalf—this is a centralized trust decision (no local API keys are required, but credentials are held/used by Membrane).
Persistence & Privilege
The skill does not request permanent presence (always:false) nor modify other skills or system-wide agent settings. It is user-invocable and can run autonomously (default), which is normal for skills.
What to consider before installing
This skill appears to be what it says: a Fastly integration implemented via the Membrane CLI/proxy. Before installing/using it, verify the @membranehq/cli package and publisher (review the npm page and the GitHub repo), and confirm you trust Membrane (https://getmembrane.com) because all proxied requests and credentials are handled by their service. Consider using `npx` instead of a global install in ephemeral environments, and prefer creating a dedicated Membrane connection/account with limited scope for testing. Also note the registry metadata omission (it doesn't list the required `membrane` binary) — treat that as an indicator to audit the skill authorship and repo before granting access.Like a lobster shell, security has layers — review code before you run it.
latestvk97c074vs492wn3k3tbh54ayh184605z
License
MIT-0
Free to use, modify, and redistribute. No attribution required.