Big Cartel
v1.0.2Big Cartel integration. Manage data, records, and automate workflows. Use when the user wants to interact with Big Cartel data.
⭐ 0· 89·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name and description match its instructions: it teaches the agent/user to use the Membrane CLI to interact with Big Cartel. Requiring a Membrane account and network access (mentioned in SKILL.md) is reasonable for this integration. The registry metadata shows no unrelated credentials or paths.
Instruction Scope
SKILL.md confines runtime actions to installing and using the Membrane CLI, logging in, creating connections, running actions, and proxying requests to the Big Cartel API. It does not instruct the agent to read unrelated files, exfiltrate data to unknown endpoints, or access unrelated credentials.
Install Mechanism
There is no install spec in the registry (instruction-only), but SKILL.md tells the user to run `npm install -g @membranehq/cli`. Installing a global npm package is a normal approach for a CLI, but it writes to the host and introduces the usual supply-chain considerations for npm packages. The manifest does not itself install anything; the instruction delegates installation to the operator.
Credentials
The skill declares no environment variables or credentials in the registry. Authentication is handled via Membrane login flow (browser or headless flow). This is proportionate to the stated purpose of accessing Big Cartel via Membrane.
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges or modify other skills. Autonomous invocation is allowed by default (disable-model-invocation: false) which is standard behavior; nothing else in the manifest asks for persistent, system-wide changes.
Assessment
This skill is coherent: it expects you to install and use the Membrane CLI and to authenticate a Membrane account that will proxy requests to Big Cartel. Before installing: (1) verify the npm package @membranehq/cli (check the npm page and the linked GitHub repo) to ensure it's the official CLI; (2) be aware that `npm install -g` writes to your system—install in a controlled environment or container if you prefer; (3) review what Membrane will be authorized to access in your Big Cartel account (tokens stored by Membrane can access your store data); (4) if you do not trust automatic agent invocation to access your store data, consider restricting the agent's permissions or refusing autonomous invocation. If you want a deeper review, provide the @membranehq/cli package manifest or the Membrane CLI repo URL for inspection.Like a lobster shell, security has layers — review code before you run it.
latestvk9726fg5czsxn0myrdhsn6bzzs8422fp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.