Dronahq
v1.0.0DronaHQ integration. Manage data, records, and automate workflows. Use when the user wants to interact with DronaHQ data.
⭐ 0· 56·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill claims to integrate with DronaHQ and its SKILL.md consistently instructs using the Membrane CLI to discover actions, create connections, and proxy API calls to DronaHQ. The declared homepage and repository point to Membrane resources, which fits the approach described.
Instruction Scope
All runtime instructions are CLI commands (membrane login, action list, action run, membrane request). The skill does not direct the agent to read arbitrary files, environment variables, or unrelated system configuration. It does instruct the use of Membrane's proxy for API calls — meaning request payloads and results will flow through Membrane's servers.
Install Mechanism
There is no formal install spec, but the SKILL.md tells users/agents to run `npm install -g @membranehq/cli` or use `npx @membranehq/cli@latest`. This is a public npm package (moderate supply-chain risk). Examples use unpinned/`latest` versions; consider pinning or using audit controls before installing globally.
Credentials
The skill does not request any environment variables, secrets, or unrelated credentials. It explicitly advises against asking users for API keys and relies on Membrane to manage credentials server-side, which is proportionate to the described workflow. Note that reliance on an external proxy means sensitive request data will be sent to Membrane.
Persistence & Privilege
The skill is instruction-only, has no install spec that writes to disk under the skill system, and is not always-enabled. It does instruct installing a global CLI, which affects the host, but the skill itself does not request persistent elevated agent privileges or modify other skills/config.
Assessment
This skill appears coherent: it uses the Membrane CLI to talk to DronaHQ and asks you to install that CLI. Before installing or running it, consider: 1) Membrane will proxy your requests and handle auth—so request/response data will traverse Membrane's servers; review Membrane's privacy/security and whether you're comfortable sending the data. 2) The SKILL.md suggests a global npm install and examples using `@latest`; prefer auditing or pinning a specific version (or use npx for one-off runs) to reduce supply-chain risk. 3) Verify the @membranehq/cli package on the npm registry and the repository linked in the SKILL.md. 4) Because this is instruction-only (no packaged code), the security surface is the commands you run; do not run the install or login commands if you cannot confirm the CLI's provenance or if the data you will send is highly sensitive.Like a lobster shell, security has layers — review code before you run it.
latestvk970n3rmmhvwgpnyrtyfr12d618448e3
License
MIT-0
Free to use, modify, and redistribute. No attribution required.