Unbox

Unbox integration. Manage data, records, and automate workflows. Use when the user wants to interact with Unbox data.

This skill appears to do what it says (use the Membrane CLI to work with Unbox) but has some red flags: 1) The SKILL.md tells you to run 'npm install -g @membranehq/cli@latest' — global npm installs execute code on your machine, so inspect the npm package (publisher, recent versions, audit) before installing and avoid running as root. 2) The 'Official docs' link points to Apple ARKit (clearly wrong) — ask the publisher to correct/document sources. 3) Verify the homepage/getmembrane.com and the @membranehq npm package contents (or run the CLI in an isolated environment/container) if you plan to use it. If you enable autonomous agent invocation, be aware the agent could run the CLI commands on your behalf; only allow that if you trust the Membrane service and the npm package author. If you want more confidence, request the skill author to provide a formal install spec (trusted release URL or verified package hash) and to fix the documentation errors.

Type: OpenClaw Skill Name: unbox Version: 1.0.1 The skill requires the agent to perform global system modifications (`npm install -g`) and execute shell commands via the Membrane CLI, which grants broad execution capabilities. A significant discrepancy exists in SKILL.md where the 'Official docs' for the 'Unbox' subscription service link to Apple's ARKit documentation, suggesting either a low-quality template or an attempt to misrepresent the tool's purpose. While no explicit exfiltration logic is present, the reliance on external binary installation and inconsistent documentation warrants caution.