Brandfetch
v1.0.0Brandfetch integration. Manage data, records, and automate workflows. Use when the user wants to interact with Brandfetch data.
⭐ 0· 30·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description say 'Brandfetch integration' and the SKILL.md exclusively instructs using the Membrane CLI to connect to Brandfetch, list actions, run actions, and proxy requests. There are no unrelated environment variables, binaries, or config paths requested.
Instruction Scope
Runtime instructions are limited to installing the Membrane CLI, authenticating (browser or headless flow), creating/listing connections, running actions, and using Membrane's proxy. The doc does not instruct reading arbitrary files, harvesting environment variables, or sending data to unexpected endpoints. It explicitly advises against asking users for Brandfetch API keys.
Install Mechanism
The SKILL.md recommends installing @membranehq/cli globally via npm (npm install -g @membranehq/cli). That is a common delivery method but does install third‑party code onto the host (global npm installs can run postinstall scripts). Because this is an instruction-only skill (no formal install spec), verify the npm package name, its publisher, and the linked repository before installing.
Credentials
No environment variables, credentials, or config paths are requested by the skill itself. Functionality depends on creating a Membrane connection that will grant Membrane access to the user's Brandfetch account — this is appropriate for a proxy/connector integration but is a permission surface the user should consciously approve.
Persistence & Privilege
The skill is not set to always:true and asks for nothing that would require elevated persistent privileges. Autonomous invocation by the agent is allowed (platform default) but the skill does not request system-wide configuration changes or other skills' credentials.
Assessment
This skill is coherent: it tells the agent to use the Membrane CLI as a proxy to Brandfetch rather than asking for raw API keys. Before installing or using it, verify the @membranehq/cli npm package and linked GitHub repo are legitimate and from a trusted publisher. Be aware that installing a global npm package runs code on your machine (postinstall hooks are possible)—install in an isolated environment if you prefer. When you create the Membrane connection, review the authorization screen and granted scopes carefully: Membrane will be able to access your Brandfetch data on your behalf. If you need tighter control, use a least-privilege or test Brandfetch account for initial trials.Like a lobster shell, security has layers — review code before you run it.
latestvk9730p4v47ckbv13n436a0k48x8477as
License
MIT-0
Free to use, modify, and redistribute. No attribution required.