Castmagic
v1.0.0Castmagic integration. Manage data, records, and automate workflows. Use when the user wants to interact with Castmagic data.
⭐ 0· 88·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill claims to integrate with Castmagic and all runtime instructions describe using the Membrane CLI to find connectors, create connections, run actions, or proxy requests to Castmagic — this matches the stated purpose.
Instruction Scope
SKILL.md confines actions to using the Membrane CLI and browser-based auth flows, listing commands to list connections, run actions, and proxy requests. It does not instruct reading unrelated files or exfiltrating data outside the Membrane/Castmagic flows. The proxy command allows arbitrary API paths for the connected service, which is expected for a connector but should be used carefully.
Install Mechanism
There is no formal install spec in the registry metadata, but SKILL.md instructs installing @membranehq/cli via npm (npm install -g). Installing a global npm CLI is a common installation path but carries the usual moderate risk of executing third-party code from the npm registry; the skill itself does not provide an install artifact or checksum.
Credentials
The skill declares no required environment variables or credentials and explicitly advises letting Membrane handle credentials instead of asking for API keys. It only requires network access and a valid Membrane account (as noted in the doc), which is proportionate to the integration.
Persistence & Privilege
The skill is instruction-only, has no install-time hooks or always:true flag, and does not request persistent system-wide privileges or modify other skill configurations. Autonomous invocation is allowed (platform default) but not combined with other high-risk requests.
Assessment
This skill appears to be what it says: a Castmagic integration that uses the Membrane CLI. Before installing, verify the @membranehq/cli npm package and publisher (check npmjs and the linked GitHub repo), prefer installing in a controlled environment (or use a local/non-global install), and use a least-privilege Membrane account/tenant for linking Castmagic. Treat the Membrane proxy like a powerful tool: it can call any API path for the connected service, so review what connection permissions you'll grant. If you need higher assurance, ask the publisher for a pinned release (version/checksum) or inspect the CLI source before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97663v7h1sb4p8n6e7v1b12ph83jp2c
License
MIT-0
Free to use, modify, and redistribute. No attribution required.