Paubox

Paubox integration. Manage data, records, and automate workflows. Use when the user wants to interact with Paubox data.

This skill appears to do what it claims (Paubox via Membrane), but before installing or using it consider: 1) PHI risk — Paubox is used for protected health information; the Membrane service will handle auth and action execution, so confirm Membrane's HIPAA compliance, DPA/BAA, and privacy policy before sending PHI through it. 2) Package provenance — the docs ask you to run `npm install -g @membranehq/cli@latest`; verify the package owner and repository on npm/GitHub and prefer `npx` or a pinned version if you want to avoid global installs. 3) Least privilege — avoid pasting secrets or PHI into free-form prompts; follow the documented connect flow so credentials remain managed by Membrane. 4) Isolation — run the CLI in a controlled environment if you are concerned about data exfiltration. If you need to avoid third‑party processing of PHI entirely, consider integrating directly with Paubox APIs (and only provide credentials to trusted code).

Type: OpenClaw Skill Name: paubox Version: 1.0.3 The skill facilitates Paubox integration by instructing the agent to perform high-risk operations, including the global installation of an NPM package (@membranehq/cli) and the execution of shell commands for authentication and API interaction. While these actions are plausibly needed for the stated purpose of using the Membrane platform, the reliance on shell-based command construction (e.g., in SKILL.md) for dynamic actions and JSON inputs presents a significant risk of shell injection if the agent does not properly sanitize user-provided data.