by 安全扫描
OpenClaw
安全
high confidenceThe skill's instructions, requirements, and runtime behavior are consistent with a FullStory integration that uses the Membrane CLI to manage connections and run actions; nothing requested appears disproportionate to that purpose.
评估建议
This skill appears internally consistent: it asks you to install the official Membrane CLI and to sign into a Membrane account, then create a Fullstory connection and run Membrane-managed actions. Before installing, verify the npm package and publisher (@membranehq/cli) and the upstream repository (the SKILL.md references https://github.com/membranedev/application-skills and https://getmembrane.com). Consider installing the CLI in a controlled environment (container or VM) if you want to limit b...详细分析 ▾
✓ 用途与能力
The name/description (Fullstory integration) match the instructions: the skill uses Membrane to connect to FullStory, discover actions, and run them. Requiring the Membrane CLI is coherent for this gateway-style integration.
✓ 指令范围
SKILL.md confines the agent to installing/using the Membrane CLI, logging in via browser/URL, creating a connection for the Fullstory connector, discovering actions, and running them. It does not instruct reading unrelated files or requesting unrelated secrets; it explicitly advises against asking users for API keys.
ℹ 安装机制
The guide recommends npm install -g @membranehq/cli@latest. Installing a global npm CLI is expected here, but global npm installs run install scripts from the registry and grant that package execution on the host — a normal but nonzero risk. The skill itself has no install spec and is instruction-only.
✓ 凭证需求
No environment variables, credentials, or config paths are required by the skill. The SKILL.md explicitly defers credential handling to Membrane (server-side), which is proportionate to the stated purpose.
✓ 持久化与权限
The skill is not always-enabled and does not request persistent privileges or modify other skills. It uses normal agent invocation behavior (agent-invocable, model-invocation allowed).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
安装命令
点击复制官方npx clawhub@latest install fullstory
镜像加速npx clawhub@latest install fullstory --registry https://cn.longxiaskill.com镜像同步中