Bidsketch
v1.0.2Bidsketch integration. Manage data, records, and automate workflows. Use when the user wants to interact with Bidsketch data.
⭐ 0· 127·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Bidsketch integration) matches the runtime instructions: all actions are performed via the Membrane CLI and Membrane's proxy to Bidsketch. One small inconsistency: the SKILL.md requires installing a global npm package and running the 'membrane' binary, but the skill metadata did not declare required binaries (node/npm or membrane) — the functionality itself is appropriate for the stated purpose.
Instruction Scope
SKILL.md only instructs use of the Membrane CLI (login, connect, action list/run, request proxy). It does not ask the agent to read arbitrary local files, ask for unrelated credentials, or transmit data to endpoints beyond Membrane/Bidsketch. The proxy feature will route arbitrary API requests through Membrane, which is expected for this integration.
Install Mechanism
There is no registry install spec, but the instructions tell the user to run `npm install -g @membranehq/cli` (public npm). Installing a global npm package is a reasonable way to get the CLI but carries the usual moderate risk of pulling code from npm and modifying system state; the skill metadata does not document this requirement.
Credentials
The skill requests no environment variables or local credentials and instructs the user to rely on Membrane to handle authentication. This is proportionate: access to Bidsketch data is obtained via the Membrane-managed connection. However, this means you must trust Membrane (getmembrane.com) with tokens and proxied request contents.
Persistence & Privilege
The skill is not always-enabled and has no special persistence or system-wide configuration changes described. It does require installing/using an external CLI, but it does not request elevated platform privileges or modify other skills.
Assessment
This skill appears to do exactly what it says: act as a Bidsketch integration using Membrane. Before installing, consider: (1) You must install the Membrane CLI (global npm install) and have Node/npm available — the registry metadata omitted this requirement. (2) Membrane will handle authentication and proxy API requests, so Membrane's servers will see the Bidsketch data and tokens — only proceed if you trust getmembrane.com/@membranehq and their CLI package. (3) Installing a global npm package modifies your system environment; prefer reviewing the package (npm page, repo, checksums) or installing in a controlled environment. (4) The skill does not request unrelated secrets or perform unexpected file access. If you need stronger assurance, ask the publisher for a signed release or more details about the exact connector implementation and the Membrane tenant being used.Like a lobster shell, security has layers — review code before you run it.
latestvk974vqrhx57kvsk1kp71326sk18439t3
License
MIT-0
Free to use, modify, and redistribute. No attribution required.