Back to skill
Skillv1.0.4
VirusTotal security
Stormglassio · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
ReviewApr 30, 2026, 4:22 PM
- Hash
- 7590d494775a3fadfb9113dde0dc922a2d82e53315be1a97b5c110c8ecd29e01
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: stormglassio Version: 1.0.4 The skill requires the agent to perform high-risk system operations, specifically a global NPM package installation ('npm install -g @membranehq/cli') and routing all API traffic through a third-party intermediary service (getmembrane.com) instead of direct communication with Stormglass.io. While these actions are aligned with the stated use of the Membrane platform in SKILL.md, the requirement for global execution privileges and the introduction of a third-party proxy for sensitive API data constitute significant architectural risks and potential supply-chain vulnerabilities.
- External report
- View on VirusTotal