Expensify
v1.0.0Expensify integration. Manage data, records, and automate workflows. Use when the user wants to interact with Expensify data.
⭐ 0· 63·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name, description, and runtime instructions all target Expensify via the Membrane platform, which is coherent. Minor mismatch: the registry metadata lists no required binaries or credentials, but the SKILL.md explicitly requires the Membrane CLI and a Membrane account (documented under 'compatibility').
Instruction Scope
SKILL.md stays within scope: it instructs how to install/use membrane, create a connection to Expensify, list/run actions, and proxy raw API requests through Membrane. It explicitly advises against asking users for API keys and relies on Membrane for auth lifecycle.
Install Mechanism
There is no formal install spec in the registry entry (skill is instruction-only), but SKILL.md directs installing @membranehq/cli via npm (global or npx). Using an npm package from a named scope is expected and acceptable, but installing global npm binaries changes the local environment and is a higher-friction action the user should review (verify package trust and permissions).
Credentials
The skill does not request any environment variables or secrets and explicitly recommends letting Membrane handle credentials. No unrelated credentials or config paths are requested.
Persistence & Privilege
The skill is not marked always:true, does not request persistent system-wide privileges, and does not modify other skills' configuration. Autonomous invocation is allowed by default but is not combined with other concerning factors here.
Assessment
This skill is instruction-only and appears to do what it says: it uses the Membrane CLI to connect to Expensify and run actions. Before installing or running commands: (1) confirm you trust the @membranehq/cli package (review its npm/GitHub page and permissions) and prefer using npx if you want to avoid a global install; (2) be aware you'll need a Membrane account and will authenticate via a browser flow; (3) understand that 'membrane request' lets you proxy arbitrary API calls through Membrane—only run requests you intend to send to Expensify; and (4) if you have organizational security policies about installing global npm packages or granting network/browser-based auth flows, follow those policies. If you want, I can fetch the @membranehq/cli repository URL and summarize its README or permissions for additional assurance.Like a lobster shell, security has layers — review code before you run it.
latestvk97480e6cyg9vm2ney7rey333d84bn51
License
MIT-0
Free to use, modify, and redistribute. No attribution required.