by 安全扫描
OpenClaw
安全
medium confidenceThe skill appears to do what it claims—it instructs the agent to use the Membrane CLI to connect to Advanced Web Ranking and proxy API calls; there are minor documentation/metadata inconsistencies but nothing that strongly suggests malicious intent.
评估建议
This skill appears to be a straightforward connector that uses the Membrane CLI to talk to Advanced Web Ranking. Before installing or using it: (1) confirm you trust Membrane (getmembrane.com) because calls and data will be proxied through their service; (2) be prepared to run a browser-based login (or headless flow) to authorize access; (3) prefer using `npx @membranehq/cli@latest` if you want to avoid a global npm install, and review the npm package page for @membranehq/cli before installing; ...详细分析 ▾
ℹ 用途与能力
The skill's name and description match the instructions: it integrates Advanced Web Ranking via Membrane. However, the package metadata declares no required binaries or primary credential while the SKILL.md explicitly requires a Membrane account and the Membrane CLI. That mismatch is likely an oversight but should be corrected.
✓ 指令范围
SKILL.md limits actions to installing/using the Membrane CLI, creating connections, listing actions, running actions, and optionally proxying requests to the Advanced Web Ranking API via Membrane. There are no instructions to read unrelated files or environment variables. The proxying behavior means data/requests will flow to Membrane and Advanced Web Ranking—this is expected for this integration.
ℹ 安装机制
The skill bundle contains no install spec, but the instructions tell the user to run `npm install -g @membranehq/cli` (and suggest `npx` for some commands). Installing a public npm CLI is a common pattern but has moderate risk (it writes code to disk and runs binaries). The absence of an explicit install spec in the skill metadata is an inconsistency worth calling out.
✓ 凭证需求
The skill does not request environment variables or unrelated credentials. It relies on a Membrane account for authentication (browser-based OAuth flows) and instructs not to ask users for API keys. The data exchanged will be proxied through Membrane—users should be aware that their Advanced Web Ranking data and API calls are transmitted to Membrane's service.
✓ 持久化与权限
The skill does not request persistent system privileges, does not set always:true, and contains no install-time scripts in the bundle. Runtime behavior depends on the Membrane CLI the user installs; autonomous invocation is allowed (default) but not an unusual privilege here.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/9
Auto sync from membranedev/application-skills
● 无害
安装命令 点击复制
官方npx clawhub@latest install advanced-web-ranking
镜像加速npx clawhub@latest install advanced-web-ranking --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制