Fena
v1.0.0Fena integration. Manage data, records, and automate workflows. Use when the user wants to interact with Fena data.
⭐ 0· 55·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description (Fena integration) matches the instructions (use Membrane CLI to connect to Fena). However the package metadata declares no required binaries while the SKILL.md explicitly requires npm (to install the CLI), the membrane CLI binary, network access, and a browser for authentication — that deployment mismatch should be documented.
Instruction Scope
Instructions stay within the stated purpose: install Membrane CLI, authenticate, create/connect to a Fena connection, list/run actions, and optionally proxy raw API calls through Membrane. Note: the proxy feature lets the agent send arbitrary requests to the Fena API on behalf of an authenticated connection, which is consistent with the integration but has broad access to the user's Fena data.
Install Mechanism
No formal install spec in the registry; SKILL.md instructs a global npm install (@membranehq/cli). This is a common but higher-friction mechanism (requires npm, network, and possibly elevated permissions). It does not download arbitrary URLs or use unknown hosts, but the user should verify the CLI package source and publisher on npm.
Credentials
The skill requests no environment variables or local credentials. Authentication is performed interactively via Membrane (OAuth/browser flow), which is proportionate to the stated purpose. There are no unexplained secret requests in the instructions.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request persistent system-wide privileges. It relies on the external Membrane service to hold tokens rather than storing local secrets.
Assessment
This skill is instruction-only and uses the Membrane CLI to access your Fena account via an OAuth/browser flow — nothing in the skill asks for your API keys or local secrets. Before installing or running it: (1) verify you trust Membrane/getmembrane.com and the @membranehq/cli package on npm (check the publisher, download counts, and source repo); (2) prefer using npx or a scoped install if you want to avoid a global npm install and elevated permissions; (3) be aware that the Membrane proxy can issue arbitrary API requests on behalf of an authenticated connection, so only connect accounts you trust and review the OAuth consent scopes during login; (4) avoid running the CLI on shared machines, and confirm the registry metadata/skill listing is updated to declare required binaries (npm, browser) to avoid surprises.Like a lobster shell, security has layers — review code before you run it.
latestvk979sb3b1rn219be2sxd642tqs84a9px
License
MIT-0
Free to use, modify, and redistribute. No attribution required.