Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Flowla
v1.0.0Flowla integration. Manage Organizations, Pipelines, Users, Filters. Use when the user wants to interact with Flowla data.
⭐ 0· 22·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name and description match the runtime instructions: it uses Membrane to access Flowla actions and APIs. However the SKILL.md requires running 'npx @membranehq/cli@latest' (Node/npm) while the registry metadata declares no required binaries — a mismatch that should be declared explicitly.
Instruction Scope
Instructions direct the agent to run the Membrane CLI to create connections, run discovered actions, and proxy requests. The proxy command accepts full URLs and Membrane will 'use it as-is' while injecting auth headers — this enables arbitrary outbound requests made with Flowla credentials and could be used to reach unexpected endpoints (including internal services) or exfiltrate data. The SKILL.md also assumes credentials are stored under ~/.membrane/credentials.json (a local persistent file) — the skill implicitly relies on that file being created/read.
Install Mechanism
There is no explicit install spec, but the runtime instructions rely on 'npx @membranehq/cli@latest', which fetches and executes a package from the public npm registry at runtime. Dynamic installs via npx run arbitrary code fetched from npm and are a moderate risk; the skill did not declare this dependency or offer an audited install path.
Credentials
The skill requests no environment variables, which is reasonable because Membrane handles auth. However it depends on a Membrane account and stores credentials at ~/.membrane/credentials.json — local credential storage and CLI-managed tokens are expected, but the SKILL.md doesn't explain credential scope/permissions or how to inspect/rotate stored tokens.
Persistence & Privilege
always:false and normal agent invocation are used (no elevated persistence). The Membrane CLI will persist credentials to the user's home directory, which is normal for CLI-based auth, but this persisted credential file increases the attack surface if the CLI or agent is compromised.
What to consider before installing
This skill is plausible for integrating Flowla via Membrane, but review these before installing:
- Verify you trust the @membranehq/cli npm package and its publisher (inspect the package on npm/GitHub, check maintainer/account reputation).
- Ensure your environment has Node/npm/npx available; the metadata should state this but does not.
- Be aware the CLI will store credentials in ~/.membrane/credentials.json — inspect that file, understand token scope/expiry, and ensure you can revoke keys if needed.
- The 'request' proxy accepts full URLs and injects Flowla auth headers: consider whether you want an agent/skill that can use your Flowla credentials to contact arbitrary endpoints (this can be used to reach internal services or exfiltrate data). If you need tighter controls, avoid granting broad access or run the skill in a sandboxed account with minimal privileges.
- If you decide to proceed, run the Membrane CLI manually first (outside any automated agent) to review behavior and created files, and confirm the connector/action IDs you plan to use.
If you want, I can list exact checks to perform on the @membranehq/cli package or draft minimally-privileged Flowla connector permissions to reduce risk.Like a lobster shell, security has layers — review code before you run it.
latestvk970b5mnkkfr2mmhrwmh06e9zs844tde
License
MIT-0
Free to use, modify, and redistribute. No attribution required.