Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Helpninja
v1.0.1HelpNinja integration. Manage data, records, and automate workflows. Use when the user wants to interact with HelpNinja data.
⭐ 0· 62·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md describes a HelpNinja integration that legitimately uses Membrane as a proxy/connector; that purpose matches the description. However the registry metadata claims no required binaries or credentials while the runtime instructions explicitly require installing and running the @membranehq/cli and having a Membrane account — an inconsistency that should be resolved.
Instruction Scope
The instructions are narrowly scoped to installing the Membrane CLI, logging in, creating/inspecting a connection, listing and running actions, or proxying API requests. They do not direct the agent to read unrelated local files or environment variables. They do, however, rely on network access and on sending requests and authentication through Membrane (which will see/hold connection credentials).
Install Mechanism
There is no formal install specification in the registry (skill is instruction-only), but SKILL.md instructs users to run `npm install -g @membranehq/cli` or `npx @membranehq/cli@latest`. Installing/running an npm package (especially global installs or npx latest) introduces moderate risk and should be done after reviewing the package and its maintainers. The absence of an install spec in metadata is an inconsistency.
Credentials
The skill declares no required env vars or primary credential, yet the instructions require a Membrane account and creation of a connection that grants Membrane access to HelpNinja. Not requesting local API keys is correct for the design, but the registry should declare that an external Membrane account/credentials are required so users understand what external access will be granted.
Persistence & Privilege
The skill does not request persistent presence (always is false) and does not attempt to modify other skills or system settings. It's an instruction-only skill with no install spec that would make it persist automatically.
What to consider before installing
This skill appears to be an integration that operates through the third‑party Membrane service and CLI. Before installing or using it: 1) Confirm you trust the Membrane project and review the @membranehq/cli package on npm/GitHub (source, maintainers, recent releases). 2) Prefer installing from a vetted source and avoid running `npx ...@latest` if you need reproducibility — pin a version you reviewed. 3) Understand that creating a connection lets Membrane (their service) access your HelpNinja account/data and perform actions on your behalf; read Membrane's privacy/security and the connector permissions. 4) Note the metadata/instruction mismatch (registry says no required binaries/credentials but SKILL.md requires the CLI and a Membrane account); ask the publisher to correct registry metadata if you need an auditable install checklist. 5) If you cannot verify Membrane or the package, do not install the CLI or provide access to your HelpNinja account.Like a lobster shell, security has layers — review code before you run it.
latestvk975nx9br4g5495djv6g1sx3es844pt5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.