Vendasta

Vendasta integration. Manage data, records, and automate workflows. Use when the user wants to interact with Vendasta data.

This skill appears to aim at integrating with Vendasta but does not explain how authentication or data flow are handled. Before installing, ask the publisher: (1) exactly how will the skill authenticate to Vendasta or Membrane ( OAuth flow, API key, Membrane token ), and where are tokens stored? (2) what endpoints or services will the agent call, and will any Vendasta data be sent to third parties (e.g., getmembrane.com)? (3) provide the full, concrete SKILL.md runbook showing commands/requests the agent will perform. If you can’t get clear answers or the skill requests sensitive credentials without documented handling, avoid installing it or run it only in an isolated/test account. Note: absence of scanner findings is expected for instruction-only skills and does not imply safety.

Type: OpenClaw Skill Name: vendasta Version: 1.0.1 The SKILL.md file contains an extremely large, anomalous block of repetitive keywords (e.g., hundreds of lines of 'App App App App') which is a strong indicator of an attempt to manipulate the AI agent's context window or bypass safety filters via token stuffing. Furthermore, the skill instructs the agent to perform high-risk operations including the global installation of an external package (npm install -g @membranehq/cli) and the execution of third-party CLI commands for authentication and data management. While these actions are consistent with the stated purpose of using the Membrane platform, the bizarre formatting and the requirement for unpinned remote code execution make this bundle highly suspicious.