ClawHub

Carbone

v1.0.2

Carbone integration. Manage data, records, and automate workflows. Use when the user wants to interact with Carbone data.

⭐ 0· 104·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The skill name/description (Carbone integration) matches the instructions: it tells the agent to install and use the Membrane CLI to connect to Carbone, list actions, run actions, upload/download templates, and proxy API requests. Nothing in the SKILL.md asks for unrelated credentials, binaries, or system access.
ℹ
Instruction Scope
Instructions are scoped to installing and using the Membrane CLI, creating a Membrane connection to a Carbone connector, running actions, and optionally proxying arbitrary Carbone API calls via Membrane. This is coherent, but it means API requests and payloads will be routed through Membrane (a third-party) rather than sent directly from the agent to Carbone — users should be aware that request bodies and data may be visible to Membrane.
ℹ
Install Mechanism
No install spec is embedded; SKILL.md instructs users to run `npm install -g @membranehq/cli`. Installing a global npm CLI is a standard approach but does write code to disk and pulls from the npm registry. This is proportionate to the task but does require trust in the @membranehq package and the npm ecosystem.
✓
Credentials
The skill requests no environment variables, no credentials, and no config paths. It explicitly directs users to use Membrane connections instead of providing API keys locally, which is consistent with the stated workflow.
✓
Persistence & Privilege
The skill is instruction-only, not always-enabled, and does not request permanent presence or modify other skills/config. Autonomous invocation is allowed by default (normal), but that alone is not a risk here given the limited local footprint.
Assessment
This skill is coherent: it uses the Membrane CLI to manage Carbone interactions rather than asking for local API keys. Before installing/using it, verify you trust Membrane (https://getmembrane.com and the @membranehq npm package) because API requests and payloads will be proxied through their service and may be visible to them. Review Membrane's docs/privacy policy, confirm the npm package maintainer and version you install, and avoid sending sensitive or regulated data through the proxy unless your organization approves. If you need direct-only integration (no third-party proxy), this skill's workflow is not appropriate.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ewr024137amewpxphnzng9184219h

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments