by 安全扫描
OpenClaw
安全
medium confidenceNULL
评估建议
This skill is internally consistent with a Membrane-to-Llama AI integration, but before installing: (1) confirm you trust the Membrane project and the npm package @membranehq/cli@latest because the instructions run npx which downloads and executes code at runtime; (2) be aware the CLI will store credentials in ~/.membrane/credentials.json — review that file and its permissions if you care about local secrets; (3) consider installing or pinning a specific, audited Membrane CLI version instead of ...详细分析 ▾
✓ 用途与能力
The skill claims to integrate with Llama AI and its SKILL.md consistently describes using Membrane to discover connectors, run actions, and proxy requests to Llama AI. Using Membrane for this purpose is plausible. Minor mismatch: the short description mentions "Manage Organizations" but the instructions focus on connectors/actions/proxy and do not explicitly document organization-management steps.
ℹ 指令范围
All runtime instructions are limited to invoking the Membrane CLI (via npx) to search connectors, create connections, list actions, run actions, or proxy requests. The doc explicitly says credentials are stored at ~/.membrane/credentials.json; it does not instruct reading unrelated files or environment variables. This scope is appropriate, but it does grant the tool (Membrane CLI) access to store and use credentials on the host.
ℹ 安装机制
No install spec is provided; instead the instructions rely on npx @membranehq/cli@latest. That means the npm package will be fetched/executed at runtime (moderate risk). This is an expected pattern for CLI-first integrations but is less controlled than a pinned, preinstalled binary or an audited package.
✓ 凭证需求
The skill does not request environment variables or unrelated credentials. However, runtime behavior creates and relies on ~/.membrane/credentials.json (local credential storage) and requires a Membrane account—these are proportionate to the skill's described use but should be noted by the user.
✓ 持久化与权限
The skill does not request always:true or other elevated installation privileges. It will cause the Membrane CLI to store credentials in the user's home directory but does not instruct modifying other skills or system-wide agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/5
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install llama-ai
镜像加速npx clawhub@latest install llama-ai --registry https://cn.longxiaskill.com