Bolt
v1.0.2Bolt integration. Manage data, records, and automate workflows. Use when the user wants to interact with Bolt data.
⭐ 0· 83·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Bolt integration) matches the instructions (use Membrane CLI to connect to Bolt and run actions). Minor inconsistency: SKILL.md lists 'Official docs: https://api.slack.com/bolt' which points to Slack's Bolt framework rather than Bolt (the delivery platform) or Membrane connector docs — likely a copy/paste/documentation error but not a functional mismatch.
Instruction Scope
Instructions are limited to installing and using the Membrane CLI (login, create connections, list/run actions, and proxy requests). They do not instruct reading arbitrary local files, accessing unrelated environment variables, or exfiltrating data outside of Membrane's proxy usage. Note: the 'membrane request' command can proxy arbitrary API calls through Membrane (expected for this integration) so users should understand what endpoints/actions are being invoked.
Install Mechanism
This is an instruction-only skill (no install spec). It advises installing @membranehq/cli from the npm registry (npm install -g or npx). Installing a global npm package is normal for CLI use but does introduce the usual supply-chain considerations for npm packages (verify package origin/signature/reputation).
Credentials
The skill declares no required env vars or credentials and relies on Membrane's hosted auth flow (browser login and connector-based credentials). That is proportionate to the stated purpose and avoids asking for raw API keys locally.
Persistence & Privilege
The skill does not request always:true, has no install-time writes specified, and does not modify other skills or system-wide settings. Agent autonomous invocation is enabled by default but is not combined with other red flags here.
Assessment
This skill appears to be a straightforward Membrane-based Bolt integration; it is instruction-only and asks you to install and use the @membranehq/cli npm package. Before installing or using it: (1) verify you trust the Membrane service and the @membranehq/cli npm package (npm package provenance/reputation), since Membrane will hold and proxy credentials and can call arbitrary endpoints on your behalf; (2) confirm the connector/action IDs and review the actions you run so you know what data is being sent/received; (3) note the SKILL.md's 'Official docs' link points to Slack Bolt (likely a documentation error) — check the homepage/repository links for accurate docs; (4) avoid pasting or sharing unrelated API keys or secrets — the skill intentionally relies on the browser-based Membrane login flow instead of asking for keys.Like a lobster shell, security has layers — review code before you run it.
latestvk975gacq08bs0mcmvk3tq11cx98421rx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.