Deployhq
v1.0.2DeployHQ integration. Manage Projects, Users, Teams. Use when the user wants to interact with DeployHQ data.
⭐ 0· 88·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description (DeployHQ integration) matches the instructions: all runtime actions are performed through the Membrane CLI and its proxy to DeployHQ. The listed actions and workflows (list projects, queue deployment, proxy requests) are coherent with the stated purpose.
Instruction Scope
SKILL.md confines the agent to using the Membrane CLI (membrane login, connect, action run, request). It does not instruct reading unrelated files, harvesting system credentials, or sending data to unexpected endpoints beyond Membrane/DeployHQ.
Install Mechanism
The skill is instruction-only and asks users to run `npm install -g @membranehq/cli`. That's a standard install route, but the registry metadata declares no required binaries. Installing a global npm package executes code from the npm registry (normal but with standard supply-chain risks). The skill does not include an install spec in the registry, so the install step is manual and not enforced by the platform.
Credentials
The skill declares no required env vars or credentials and explicitly instructs not to ask users for API keys, relying on Membrane browser-based auth and stored connections. Requiring a Membrane account and network access is proportionate to the purpose.
Persistence & Privilege
The skill is not set to always: true and does not request elevated or persistent platform-wide privileges. It does require the user to install a CLI but does not modify other skills or system configs beyond that.
Assessment
This skill appears to do what it says: it uses the Membrane CLI to access DeployHQ. Before installing, verify the @membranehq/cli package on npm and the referenced GitHub repo/homepage (getmembrane.com) to ensure you trust the publisher. Be aware that the SKILL.md asks you to globally install an npm package (which runs code from the npm registry) and that you'll authenticate via a browser to allow Membrane to store credentials. If you have supply-chain concerns, install the CLI in an isolated environment (container or VM), or inspect the package source first. The skill itself does not request API keys or other unrelated system credentials.Like a lobster shell, security has layers — review code before you run it.
latestvk97dpmqn9zfhbmstf849dzp82x843r2m
License
MIT-0
Free to use, modify, and redistribute. No attribution required.