Ashby
v1.0.2Ashby integration. Manage Persons, Users, Roles. Use when the user wants to interact with Ashby data.
⭐ 0· 63·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Ashby integration) matches the instructions: all operations are performed via the Membrane CLI and Membrane connections to Ashby. There are no unrelated environment variables, binaries, or config paths requested.
Instruction Scope
Instructions remain within the expected scope (install Membrane CLI, create/inspect connections, run pre-built actions, or proxy Ashby API calls through Membrane). Note: proxying allows arbitrary Ashby API requests via Membrane, which is expected for full integration but grants broad access to Ashby data when a connection exists.
Install Mechanism
No install spec in the registry (instruction-only), but the SKILL.md tells users to run `npm install -g @membranehq/cli`. Installing a global npm package is a normal, traceable action but does modify the system; verify the package provenance (npm registry/package maintainer) before installing.
Credentials
The skill declares no required env vars or credentials. It relies on Membrane's interactive/browser-based auth flow rather than asking for API keys, which is proportionate to the integration's needs.
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. It can be invoked autonomously (default), which is normal — be aware that autonomous runs with an active Membrane connection could perform actions against Ashby.
Assessment
This skill appears to do what it says: it uses the Membrane CLI to access Ashby. Before installing or using it, (1) confirm you trust Membrane as a third party since it will mediate Ashby access and hold tokens; (2) review the @membranehq/cli package on npm (publisher, recent versions) before running a global install; (3) when creating a Membrane connection, grant only the least privileges needed for the task; and (4) be mindful that if the agent is allowed to run this skill autonomously and a connection exists, the agent can take actions against your Ashby data via Membrane. If you want extra caution, create a low-privilege/test Ashby/Membrane connection first and test actions there.Like a lobster shell, security has layers — review code before you run it.
latestvk977h26s3zptrazvdqnt5mww0x84380j
License
MIT-0
Free to use, modify, and redistribute. No attribution required.