Givingfuel
v1.0.2GivingFuel integration. Manage Campaigns, Donors, Funds. Use when the user wants to interact with GivingFuel data.
⭐ 0· 107·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The SKILL.md describes a GivingFuel integration that operates via the Membrane CLI and Membrane-hosted connections (consistent with the description). Minor inconsistency: the runtime instructions require installing/running the `membrane` CLI (installed via `npm -g`), but the skill metadata lists no required binaries — the SKILL.md therefore implicitly requires npm/node or the membrane binary to be available.
Instruction Scope
Instructions are focused on installing the Membrane CLI, logging in, creating or reusing a GivingFuel connection, running pre-built actions, or proxying requests through Membrane. They do not instruct reading arbitrary host files, exporting local secrets, or contacting unexpected third-party endpoints beyond Membrane/GivingFuel.
Install Mechanism
There is no install spec in the registry (instruction-only), but SKILL.md directs the user to run `npm install -g @membranehq/cli`. Global npm installs run arbitrary code from the npm registry — this is a moderate-risk action the user will perform outside the skill. The skill itself does not perform downloads.
Credentials
The skill declares no required environment variables or credentials and explicitly instructs users not to supply API keys, relying instead on Membrane to manage credentials. This is proportionate to the stated purpose. Note: trust is delegated to Membrane's server-side credential handling.
Persistence & Privilege
The skill does not request forced permanence (always: false) and will not autonomously alter other skills or system-wide agent settings. The only persistent effect described is installing/using the Membrane CLI and creating a Membrane connection (user-driven).
Assessment
This skill looks coherent but requires you to install and trust the @membranehq/cli package and to use a Membrane account. Before installing: (1) confirm you trust getmembrane.com and the @membranehq/cli npm package (global npm installs execute code on your machine); (2) run the CLI in an isolated environment if you want to limit side effects; (3) be aware that Membrane will handle GivingFuel credentials server-side — you are delegating access to that third party; (4) review any commands before running and only create connections for accounts you control. If you are uncomfortable installing a global npm package or delegating auth to Membrane, do not install or use this skill.Like a lobster shell, security has layers — review code before you run it.
latestvk9739nyzwnjemtcffp804vytx5843kx0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.