Commpeak
v1.0.2CommPeak integration. Manage data, records, and automate workflows. Use when the user wants to interact with CommPeak data.
⭐ 0· 109·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (CommPeak integration) matches the instructions (commands to discover/connect/run CommPeak actions via the Membrane CLI). The skill delegates auth and proxying to Membrane, which explains why no CommPeak API keys or other credentials are requested locally.
Instruction Scope
SKILL.md confines runtime actions to installing/using the Membrane CLI, logging in, listing/connecting actions, running actions, and optionally proxying API requests. It does not instruct reading arbitrary files, environment variables, or unrelated system configuration.
Install Mechanism
There is no embedded install spec in registry metadata (this is instruction-only), but the instructions tell the user to run `npm install -g @membranehq/cli`. Using a public npm package is expected for a CLI-based integration, but global npm installs modify the system PATH and execute code from the npm registry — verify the package name and publisher (@membranehq) before installing.
Credentials
The skill does not request local env vars or secrets (good). However, it relies on Membrane's cloud service to manage CommPeak credentials and to proxy requests — this means CommPeak authentication and API traffic will be handled by Membrane servers (getmembrane.com). Users should understand and trust that third party with access to their CommPeak data.
Persistence & Privilege
The skill is not marked always:true and does not request system-wide configuration changes. Autonomous invocation is allowed (platform default) but there are no additional privileged behaviors or modifications to other skills.
Assessment
This skill appears coherent, but before installing: 1) Confirm you trust Membrane (getmembrane.com) because auth and API traffic are proxied through their service — review their privacy/security docs. 2) Verify the npm package identity (@membranehq/cli) and, if you prefer, install it in a controlled environment (container, VM, or non-global npm prefix) rather than globally. 3) If you need stronger assurance, inspect the Membrane CLI source (the repo URL is provided in SKILL.md) to confirm it does only what you expect. 4) Be aware that commands like `membrane request CONNECTION_ID /path` will transmit data to Membrane and then CommPeak; do not use it with highly sensitive data unless you accept that data transit path. 5) Because the skill source is listed as unknown in the registry metadata, consider verifying the publisher identity on the registry or GitHub before wider use.Like a lobster shell, security has layers — review code before you run it.
latestvk97dk8vep5c2pcmdqg5ygeg2n9843tx8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.