Appointo
v1.0.2Appointo integration. Manage data, records, and automate workflows. Use when the user wants to interact with Appointo data.
⭐ 0· 116·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the instructions: the SKILL.md shows how to manage Appointo via Membrane. Required capabilities (network access, Membrane CLI) are appropriate for an external-app integration and no unrelated credentials or binaries are demanded.
Instruction Scope
Instructions are focused on installing and using the Membrane CLI, discovering actions, running actions, and proxying requests to Appointo. This grants broad functional reach (you can run arbitrary proxied API calls via the connection), which is expected for an integration but gives the agent the ability to read/modify Appointo data if authorized. The doc explicitly tells the agent not to ask users for API keys, and it does not instruct the agent to read unrelated local files.
Install Mechanism
The skill is instruction-only (no install spec), but recommends installing @membranehq/cli globally via npm. That is a moderate-risk install step (third-party code from npm); the skill does not itself perform the install but instructs the user/agent to do so. Users should verify the npm package and prefer non-global or pinned installs if desired.
Credentials
No environment variables, secrets, or config paths are declared or required by the skill. The Membrane CLI handles authentication and will persist credentials locally as part of its normal operation; that storage is a reasonable and proportional consequence of using a CLI-based connector.
Persistence & Privilege
Skill is not always-enabled and has no install-time hooks in the registry. The agent is allowed autonomous invocation (platform default), which combined with connector access means an invoked skill could operate without additional user prompts — this is expected but worth noting for high-sensitivity accounts.
Assessment
This skill is coherent, but before installing or using it: 1) Verify the @membranehq/cli package on npm/GitHub (author, downloads, source code) and consider installing a specific version or locally (avoid -g if you prefer stricter control). 2) Understand that when you create a Membrane/Appointo connection the CLI will store credentials locally and the agent (if invoked) can run actions or proxy arbitrary API requests under that connection; only authorize accounts you trust. 3) If you require tighter control, restrict agent autonomy or require explicit user confirmation before the skill runs actions that modify data. 4) Because the skill's source/owner in the registry is not well-known, review Membrane's privacy/security docs and the CLI source before granting access.Like a lobster shell, security has layers — review code before you run it.
latestvk97dj6edvy1yk3pc3qf5dfr9kn8434r6
License
MIT-0
Free to use, modify, and redistribute. No attribution required.