Finmei
v1.0.2Finmei integration. Manage Organizations, Pipelines, Users, Goals, Filters. Use when the user wants to interact with Finmei data.
⭐ 0· 69·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill describes Finmei integration and uses Membrane as a proxy/connector which matches the stated purpose. However, the registry metadata declares no required binaries while the SKILL.md instructs installing the Membrane CLI via npm - the skill implicitly requires Node/npm and ability to install a global npm package.
Instruction Scope
All runtime instructions are limited to installing and using the membrane CLI, creating/listing connections, running actions, and proxying requests through Membrane. The instructions do not ask for unrelated file reads, unrelated environment variables, or exfiltration. They explicitly advise against asking users for API keys and use browser-based auth.
Install Mechanism
No platform install spec is included in registry metadata, but the SKILL.md directs users to run `npm install -g @membranehq/cli`. Installing a public npm package globally is a reasonable approach for a CLI, but it requires network access and writes to the system's npm global location; verify the npm package and publisher before installing.
Credentials
The skill does not request environment variables or credentials in the registry metadata. The instructions rely on Membrane to manage credentials server-side and explicitly recommend not asking users for API keys, which is proportionate to the stated function.
Persistence & Privilege
The skill is instruction-only, has no install-time persistence specified, and 'always' is false. It does not request elevated or permanent presence in the agent environment.
Assessment
This skill appears to do what it claims: it uses the Membrane CLI to talk to Finmei. Before installing or running it: 1) ensure you have Node/npm available (the SKILL.md assumes you will run `npm install -g @membranehq/cli`); 2) verify the @membranehq/cli package and publisher (check the npm page and repository) before a global install; 3) be aware the CLI will open browser-based auth flows and Membrane will hold credentials server-side; 4) be cautious when using the proxy feature—it will send arbitrary paths to the Finmei API via Membrane, so only request endpoints you intend; 5) if you prefer, run the CLI in an isolated environment (container/VM) to limit system-wide changes. Overall the skill is coherent, but confirm the npm package/source if you plan to install it.Like a lobster shell, security has layers — review code before you run it.
latestvk970he417504nv4vff9rfgqkfs84236e
License
MIT-0
Free to use, modify, and redistribute. No attribution required.