by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill is coherent: it instructs the agent to use the Membrane CLI to manage Typeform data rather than asking for raw API keys. Before installing or following the instructions: 1) Verify the @membranehq/cli package and its publisher (review the package on npm and the GitHub repo) before running a global npm install. 2) Understand that creating a Membrane connection hands Membrane the ability to access your Typeform account — review Membrane's privacy/security documentation. 3) Be cautious ab...详细分析 ▾
✓ 用途与能力
The skill is an instruction-only Typeform integration that delegates API access and auth to the Membrane CLI/service. Requesting network access and a Membrane account is coherent with the described functionality; no unrelated credentials, binaries, or config paths are requested.
✓ 指令范围
SKILL.md only instructs installing the Membrane CLI and using its commands (login, connect, action list/run, etc.) to manage Typeform resources. It does not direct the agent to read unrelated files or exfiltrate data outside the Membrane workflow. Destructive actions (delete-form/delete-responses) are listed as available — these are expected for a management skill but are sensitive.
ℹ 安装机制
The doc recommends installing @membranehq/cli via `npm install -g`. This is a typical approach but does require running third-party code with global install privileges; users should vet the npm package and its publisher before installing. There is no automatic install performed by the skill itself (instruction-only).
✓ 凭证需求
The skill declares no required env vars and relies on Membrane to handle Typeform credentials server-side. That is proportionate to the described purpose. Note: using Membrane centralizes access to Typeform credentials — users should be comfortable trusting Membrane with those tokens.
✓ 持久化与权限
always is false and the skill is user-invocable. The skill does not request persistent system privileges or attempt to modify other skills or system-wide configuration. Autonomous invocation is allowed by default but not excessive here; consider limiting agent autonomy if you want to prevent destructive actions.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.32026/3/8
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install typeform-integration
镜像加速npx clawhub@latest install typeform-integration --registry https://cn.longxiaskill.com镜像同步中