Commercehq
v1.0.2CommerceHQ integration. Manage data, records, and automate workflows. Use when the user wants to interact with CommerceHQ data.
⭐ 0· 131·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description say 'CommerceHQ integration' and the instructions show how to connect to CommerceHQ via the Membrane CLI, list and run actions, and proxy API requests. Required resources (network, Membrane account, Membrane CLI) are proportionate to that purpose.
Instruction Scope
The SKILL.md only instructs the agent to install and run the Membrane CLI, create/connect connections, list actions, run actions, and optionally proxy API requests. It does not direct reading unrelated files, asking for unrelated credentials, nor transmitting data to unexpected endpoints beyond the described Membrane/CommerceHQ flow.
Install Mechanism
The skill recommends installing @membranehq/cli via npm (global). This is expected for a CLI-based integration but carries the standard risk of executing third-party npm package code on the host. The package and repo references (getmembrane.com and github.com/membranedev) look plausible; verify you are installing the official package and review its reputation before installing globally.
Credentials
The skill declares no required environment variables or credentials. It explicitly instructs to let Membrane handle authentication rather than asking for API keys locally, which is proportionate. Note: using Membrane centralizes credentials on their service, so trust in Membrane's security model is required.
Persistence & Privilege
The skill does not request always:true, does not request system config paths, and provides no code that would persist on disk (it's instruction-only). It does require installing a CLI if the user follows the guide, but the skill itself does not claim persistent system privileges.
Assessment
This skill is internally consistent: it uses the Membrane CLI to access CommerceHQ and does not request unrelated credentials. Before installing, verify the @membranehq/cli package is the official package (check the npm page and GitHub repo), and review its maintainers and recent releases. Installing npm packages globally executes code on your machine—only proceed if you trust the package. Also review Membrane's privacy/security docs because the integration relies on Membrane to hold and refresh CommerceHQ credentials server-side. If you prefer not to trust a third-party service with store credentials, consider interacting directly with CommerceHQ's official API using credentials you control.Like a lobster shell, security has layers — review code before you run it.
latestvk977v3gy8a2w0wpq5bf2sks1zd8434bc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.