Avaza
v1.0.3Avaza integration. Manage Organizations. Use when the user wants to interact with Avaza data.
⭐ 0· 277·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The SKILL.md consistently describes an Avaza integration implemented via the Membrane CLI. However, the skill's metadata lists no required binaries while the runtime instructions instruct the user to install a global npm package (@membranehq/cli), which implicitly requires Node/npm to be available. This is a minor mismatch but not a functional inconsistency.
Instruction Scope
Instructions are narrowly scoped to installing the Membrane CLI, creating a connection, listing/running actions, and optionally proxying requests to the Avaza API via Membrane. The instructions do not ask the agent to read unrelated files or environment variables or to exfiltrate data to third-party endpoints outside of the Membrane/Avaza flows.
Install Mechanism
Installation is an npm global package (npm install -g @membranehq/cli). This is a common approach but has moderate risk because it executes code from the npm registry and installs a global binary; no version pin or checksum is provided. The skill is instruction-only (no code bundled), so the install step happens outside the skill bundle.
Credentials
No environment variables or credentials are declared or required by the skill. Authentication is delegated to Membrane via an interactive browser flow or headless code exchange, which is proportional for this kind of integration. The SKILL.md explicitly advises not to ask users for API keys, which aligns with least-privilege practices.
Persistence & Privilege
The skill does not request always:true, does not require persistent modification of other skills or global agent configuration, and is user-invocable. The only persistent change it suggests is installing the Membrane CLI, which is local to the host and expected for CLI-based integrations.
Assessment
This skill appears to do what it says (Avaza integration via Membrane) but before installing: 1) Ensure you have Node/npm installed — the SKILL.md instructs a global npm install but the skill metadata doesn't declare this requirement. 2) Only install @membranehq/cli from the official npm package and verify the package name and publisher match the Membrane project you trust. 3) Installing a global npm package runs code on your machine — if you don't trust the publisher, avoid installing it. 4) When you connect Avaza via Membrane, the connector gains whatever Avaza scopes the OAuth flow requests; review and limit scopes if possible. 5) The skill delegates auth and proxies API calls through Membrane; review Membrane's privacy/security docs and the connector's permissions before granting access. 6) Avoid pasting or sharing Avaza API keys manually; follow the browser-based auth flow described.Like a lobster shell, security has layers — review code before you run it.
latestvk97cpa3662nwheaj9pv44vts99843nr2
License
MIT-0
Free to use, modify, and redistribute. No attribution required.