Bombora
v1.0.2Bombora integration. Manage data, records, and automate workflows. Use when the user wants to interact with Bombora data.
⭐ 0· 51·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description (Bombora integration) matches the instructions (how to use Membrane to connect to Bombora). Small mismatch: the registry metadata lists no required binaries, yet SKILL.md instructs installing the @membranehq/cli (so the skill implicitly requires the 'membrane' CLI). This is a minor documentation inconsistency but not a functional red flag.
Instruction Scope
SKILL.md stays on-topic: it explains installing and using the Membrane CLI, creating connections, listing actions, running actions, and proxying requests to Bombora. It does not ask the agent to read unrelated files, fetch unrelated credentials, or exfiltrate data to unexpected endpoints. It explicitly advises against asking users for API keys.
Install Mechanism
There is no formal install spec in the registry (instruction-only), but the instructions ask the user to run 'npm install -g @membranehq/cli' or use 'npx'. Installing a known npm CLI is a common pattern; because there is no automated install block, the agent itself won't write binaries to disk unless the user follows the prose. Users should verify the npm package identity before global installation.
Credentials
The skill declares no required environment variables or credentials and the instructions show authenticating via Membrane/browser flows. That is proportionate for a connector-style integration; no unrelated secrets are requested.
Persistence & Privilege
always is false, and the skill does not request persistent system-wide privileges or modify other skills. It relies on the Membrane service for credential management and does not ask to store additional agent-wide settings.
Assessment
This skill is an instruction-only adapter that expects you to use the Membrane CLI to connect your Bombora account. Before installing or running anything: verify the @membranehq/cli npm package and the vendor (getmembrane.com / the GitHub repo) are legitimate and trustworthy; be aware 'npm install -g' requires elevated privileges on many systems; prefer using 'npx' if you don't want a global install; understand that connecting will grant Membrane access to your Bombora account (Membrane claims to handle auth server-side); do not paste Bombora API keys into chat—use the connector/browser auth flow as instructed; and consider testing this in an isolated account or environment if you are cautious. If you want more assurance, ask the maintainer/source for the exact npm package link and the repository commit/tag corresponding to the CLI referenced in the docs.Like a lobster shell, security has layers — review code before you run it.
latestvk97av80ecptstceg8pvbtd9579843p28
License
MIT-0
Free to use, modify, and redistribute. No attribution required.