Dyspatch
v1.0.2Dyspatch integration. Manage data, records, and automate workflows. Use when the user wants to interact with Dyspatch data.
⭐ 0· 72·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill claims Dyspatch integration and the SKILL.md shows how to use the Membrane CLI to connect to Dyspatch and run actions — this is coherent. Minor mismatch: the registry metadata lists no required binaries, but the instructions clearly require the 'membrane' CLI to be available.
Instruction Scope
Instructions are focused on installing and using the Membrane CLI to discover/run actions and proxy requests to the Dyspatch API. That scope is appropriate for an integration skill, but the proxy capability allows arbitrary API requests via the connection (i.e., any Dyspatch endpoint accessible to the connection can be invoked). The skill does not instruct reading unrelated files or secrets.
Install Mechanism
This is instruction-only (no code files). The SKILL.md recommends 'npm install -g @membranehq/cli' (public npm). That's a normal but non-trivial install: global npm installs execute third-party code and create a system-wide binary. Using 'npx' is suggested elsewhere in the document and is a lower-impact alternative. There is no obscure download URL or archive extraction.
Credentials
The skill declares no required environment variables or credentials and explicitly advises not to ask users for API keys, instead using Membrane-managed connections. That is proportionate to its stated purpose. Note: actual access to Dyspatch data depends on the permissions granted to the Membrane connection created at runtime.
Persistence & Privilege
The skill is not marked 'always' and is user-invocable only. It does not request persistent platform-level privileges. The only persistent effect would be the optional global installation of the Membrane CLI (user action), which is outside the skill's own install metadata.
Assessment
This skill is coherent: it tells you to install and use the Membrane CLI to manage Dyspatch resources rather than asking for API keys. Before installing or using it, consider: (1) Trust the Membrane service and the @membranehq/cli package — global npm installs run third-party code; prefer running with 'npx' if you want to avoid a global install. (2) Verify what scopes/permissions the Membrane connector will request when you authenticate — the connector can proxy arbitrary Dyspatch API calls, so grant only needed permissions. (3) Note the registry metadata omission: the skill did not declare the required 'membrane' binary even though the instructions require it — confirm that your runtime environment can safely run the CLI. (4) If you need stricter control, review the Membrane connector configuration and audit its logs/activities on your account. If you want, I can list the exact Membrane commands the skill uses and suggest a minimal subset of actions/scopes to approve when connecting.Like a lobster shell, security has layers — review code before you run it.
latestvk974yfkgben8trjwhx5fy0dnx5842faq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.