Autobound
v1.0.2Autobound integration. Manage data, records, and automate workflows. Use when the user wants to interact with Autobound data.
⭐ 0· 118·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The SKILL.md purpose (Autobound integration) matches the runtime instructions (use Membrane CLI to connect, list actions, run actions, and proxy requests). However, the registry metadata lists no required binaries while the instructions explicitly require installing and running the @membranehq/cli; that metadata omission is an inconsistency that could confuse automated installers or reviewers.
Instruction Scope
Instructions are narrowly scoped to installing and using the Membrane CLI, performing browser-based login, creating connections, listing and running actions, and proxying requests to Autobound through Membrane. The skill does not instruct reading unrelated system files or environment variables, nor does it direct data to unexpected external endpoints beyond Membrane/Autobound.
Install Mechanism
This is an instruction-only skill with no platform install spec; it tells users to run `npm install -g @membranehq/cli`. Global npm installs are common but require elevated permissions on some systems and write to disk—this is moderate risk operationally. There is no registry-provided install block, which is an operational omission (not necessarily malicious).
Credentials
The skill declares no required environment variables or credentials and explicitly instructs using Membrane connections (server-side auth) rather than asking users for API keys. This is proportionate to the stated functionality. Users should still trust Membrane as it will hold and refresh Autobound credentials on their behalf.
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. It does not instruct modifying other skills or system-wide agent settings. Autonomous invocation is allowed (platform default) but not combined with other red flags here.
Assessment
This skill is instruction-only and appears to do what it says: use the Membrane CLI to interact with Autobound. Before installing or running it: (1) Confirm you trust Membrane/@membranehq (check the npm package publisher and the GitHub repo/homepage) because Membrane will store and refresh your Autobound credentials; (2) be aware the SKILL.md asks you to run `npm install -g @membranehq/cli`—global npm installs may require sudo/admin rights and modify your environment; (3) verify the OAuth/connection scopes requested when you connect Autobound so you only grant needed permissions; (4) consider whether you want the agent to be able to invoke this skill autonomously (platform default) or restrict it if you prefer manual control; and (5) note the registry metadata omitted declaring the Membrane CLI as a required binary — the omission is likely an administrative oversight but worth noting.Like a lobster shell, security has layers — review code before you run it.
latestvk97dmk1ebq4cksj17qjfa755e9842aym
License
MIT-0
Free to use, modify, and redistribute. No attribution required.