Mojo Helpdesk

Mojo Helpdesk integration. Manage Tickets, Users, Organizations, Reports. Use when the user wants to interact with Mojo Helpdesk data.

This skill appears to be what it claims: it uses Membrane to talk to Mojo Helpdesk and doesn’t ask for unrelated secrets. Before installing or running it: (1) verify the Membrane CLI package and publisher on npm (check maintainer, download counts, recent versions); (2) prefer using `npx` or an ephemeral install instead of `npm install -g` if you want to avoid installing global binaries; (3) be careful with the login/device code flow — only paste device codes or tokens into trusted interfaces and verify the auth URL is legitimately from Membrane; (4) review Membrane's privacy/security docs to understand what data it stores or proxies; and (5) if you need higher assurance, check the referenced GitHub repository code and confirm the package hash/signature before installing. These checks will reduce risk even though the skill itself is coherent.

Type: OpenClaw Skill Name: mojo-helpdesk Version: 1.0.3 The skill instructions in SKILL.md direct the AI agent to install a global npm package (@membranehq/cli) and execute shell commands to interact with the Membrane platform. This pattern introduces high-risk behaviors, including potential shell injection vulnerabilities when constructing command-line arguments from user input and reliance on external third-party binaries. While these actions are plausibly needed for the stated Mojo Helpdesk integration, the broad shell access and external dependencies meet the criteria for a suspicious classification.