by 安全扫描
OpenClaw
安全
medium confidenceThe skill's instructions and requirements align with its stated purpose (it uses the Membrane CLI to proxy to Interswitch APIs); the only noteworthy points are that it asks you to install a global npm CLI and the registry publisher is unclear, so verify the CLI's origin before installing.
评估建议
This skill is internally coherent: it expects you to use the Membrane CLI to connect to Interswitch and does not request unrelated secrets. Before installing: (1) verify the npm package (@membranehq/cli) and its upstream repository/maintainer to ensure you are installing the official CLI, (2) prefer installing in a controlled environment or using a tool-specific install method (not necessarily global) if you are cautious about global npm packages, (3) be aware that any data you send via the CLI ...详细分析 ▾
✓ 用途与能力
The skill claims to integrate with Interswitch Group and all runtime instructions use the Membrane CLI to discover connectors, create connections, run actions, and proxy API requests to Interswitch. Requesting a Membrane account and network access is coherent with this purpose.
✓ 指令范围
SKILL.md is focused on installing and using the Membrane CLI to authenticate and interact with Interswitch endpoints. It does not instruct the agent to read unrelated files, export arbitrary environment variables, or exfiltrate data to unexpected endpoints beyond Membrane/Interswitch.
ℹ 安装机制
There is no install spec in the bundle (instruction-only), but the runtime instructions tell users to run 'npm install -g @membranehq/cli'. Installing a global npm package is a reasonable way to acquire the CLI, but it is a moderate-risk operation: verify the package name, its publisher, and the upstream repository before installing, since npm packages run code on install and will be placed on disk.
✓ 凭证需求
The skill declares no required environment variables or credentials and instead relies on Membrane to manage auth. That is appropriate for a connector-based integration. The SKILL.md explicitly advises not to ask users for API keys, which is consistent with the declared scope.
✓ 持久化与权限
The skill does not request 'always: true' and contains no install-time scripts or instructions that modify other skills or system-wide agent settings. It asks the user to run CLI commands locally; there is no elevated or permanent agent privilege requested by the skill itself.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/9
Auto sync from membranedev/application-skills
● 无害
安装命令 点击复制
官方npx clawhub@latest install interswitch-group
镜像加速npx clawhub@latest install interswitch-group --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制