Duffel
v1.0.2Duffel integration. Manage data, records, and automate workflows. Use when the user wants to interact with Duffel data.
⭐ 0· 79·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill is an instruction-only Duffel integration that relies on the Membrane CLI to access Duffel APIs. That aligns with the described purpose, but the SKILL.md requires the 'membrane' binary (npm @membranehq/cli) while the skill's declared requirements list no required binaries — a metadata omission/inconsistency.
Instruction Scope
Instructions are scoped to installing and using the Membrane CLI (login, create/connect, list actions, run actions, proxy requests). They do not ask the agent to read unrelated files, environment variables, or send data to unexpected endpoints. It instructs interactive browser-based auth and a headless code-complete flow.
Install Mechanism
No registry install spec exists, but SKILL.md instructs installing a global npm package (npm install -g @membranehq/cli) or using npx. Installing from npm is common but carries moderate risk — you should verify the package and source on npm/GitHub before installing globally.
Credentials
The skill declares no required environment variables or primary credential and explicitly says Membrane handles auth/server-side. That is proportionate to the instructions, which instead rely on interactive Membrane login and a Membrane account.
Persistence & Privilege
The skill is instruction-only, not always-enabled, and does not request persistent system privileges or modify other skills. Autonomous model invocation is allowed by default but not combined with other concerning privileges.
Assessment
This skill is coherent: it tells you to use the Membrane CLI as a proxy to Duffel rather than embedding Duffel keys locally. Before installing: (1) verify the npm package @membranehq/cli and its GitHub/release page to ensure it's legitimate; (2) prefer using npx if you don't want a global install; (3) be aware you will authenticate via browser and grant Membrane access to Duffel on your behalf; (4) confirm Membrane's privacy/security policies and the permissions requested during login; and (5) note the skill metadata omitted listing the required 'membrane' binary — treat that as a minor inconsistency and verify the CLI manually before proceeding.Like a lobster shell, security has layers — review code before you run it.
latestvk97a4m3z4p010jc50hk3r57765842fx2
License
MIT-0
Free to use, modify, and redistribute. No attribution required.