by 安全扫描
OpenClaw
安全
high confidenceThe skill's instructions, requirements, and behavior are coherent with a Splunk integration implemented via the Membrane platform; it asks you to install and use the Membrane CLI and does not request unrelated credentials or system access.
评估建议
This skill delegates Splunk access to the Membrane platform — installing and logging into the Membrane CLI will cause Splunk credentials and data to be managed and proxied by that third party. Before installing, verify you trust @membranehq/cli (check the package publisher and repository), confirm organizational policy allows a third party to access Splunk data, and consider least-privilege connections (scoped accounts) for the Splunk connection. Also prefer installing CLIs from a vetted source ...详细分析 ▾
✓ 用途与能力
The name/description (Splunk integration) match the instructions: the skill delegates Splunk access to the Membrane platform and describes how to create connections and run actions. Requested tools (Membrane CLI) and network access are appropriate for this purpose.
ℹ 指令范围
SKILL.md confines runtime actions to installing/using the Membrane CLI, logging into Membrane, creating a Splunk connection, and discovering/running Membrane actions. It does not instruct reading unrelated files or environment variables. Notable: all Splunk access is proxied through Membrane, meaning Splunk data and credentials are handled by that third party (the doc explicitly recommends not asking users for API keys).
ℹ 安装机制
No install spec in registry, but SKILL.md instructs using npm to install @membranehq/cli (global install or npx). Installing an npm package from the public registry is typical for a CLI but carries the normal supply-chain/trust considerations (verify package authenticity and source).
✓ 凭证需求
The skill does not request environment variables, system config paths, or unrelated credentials. The only credential interaction is via Membrane's login flow and the creation of a Splunk connection (handled by Membrane), which is proportionate to a Splunk integration.
✓ 持久化与权限
The skill is not always-enabled and does not request elevated platform privileges or make changes to other skills. It relies on the agent invoking the Membrane CLI when needed (normal behavior).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
安装命令
点击复制官方npx clawhub@latest install splunk
镜像加速npx clawhub@latest install splunk --registry https://cn.longxiaskill.com镜像同步中