Gobiolink
v1.0.2Gobio.link integration. Manage Organizations, Users. Use when the user wants to interact with Gobio.link data.
⭐ 0· 106·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill claims to manage Gobio.link via the Membrane CLI, which matches the SKILL.md content. However, the registry metadata lists no required binaries or primary credential while the instructions explicitly require installing and running the Membrane CLI (npm/@membranehq/cli) and a Membrane account. This is a minor inconsistency in declared requirements vs. runtime guidance.
Instruction Scope
SKILL.md confines actions to using the Membrane CLI to discover connectors, create connections, run pre-built actions, and proxy requests to Gobio.link. It does not instruct reading unrelated files, harvesting system secrets, or exfiltrating data to arbitrary endpoints. The proxy capability can perform destructive API calls (delete-project, delete-link), so callers should require explicit confirmation before destructive operations.
Install Mechanism
There is no formal install spec in the registry; the README instructs the user to run `npm install -g @membranehq/cli`. Installing from npm is expected for a CLI, but the skill metadata did not declare required binaries (node/npm) or that a global install will be performed. Because this is an instruction-only skill with manual install steps, there's no direct package payload in the skill bundle to scan.
Credentials
The skill requests no environment variables or credentials and explicitly advises against asking users for API keys, relying on Membrane to manage auth. Requiring a Membrane account and network access is proportionate to the stated purpose. There are no unrelated credential requests.
Persistence & Privilege
The skill is not always-enabled and does not request persistent system privileges or modify other skills. It is user-invocable and can be run by the agent; this is normal. No evidence of the skill attempting to change agent-wide config or persist credentials locally.
Assessment
This skill is an instruction-only integration that uses the Membrane CLI to talk to Gobio.link. Before installing or using it: 1) Be prepared to install the Membrane CLI (npm/@membranehq/cli) — you will need node/npm or a host-provided CLI. The registry metadata doesn't list that dependency, so ensure your environment supports it. 2) The Membrane service will hold authentication and proxy requests to Gobio.link; trust in Membrane (getmembrane.com/@membranehq package) is required because it will have access to your Gobio.link data. Review Membrane's docs/privacy and verify the npm package name and publisher. 3) The skill can run proxy requests and pre-built actions that may modify or delete data (projects, links, QR codes). Require explicit user confirmation for destructive operations and limit autonomous use if you don't want the agent to perform deletions. 4) Because this is an instruction-only skill, there is no bundled code to scan — that reduces visibility. If you need higher assurance, request an install spec, the exact CLI package/source, or test in an isolated account before granting access to production data.Like a lobster shell, security has layers — review code before you run it.
latestvk971aa84cehmjhn8tst5y3r9ms842qxv
License
MIT-0
Free to use, modify, and redistribute. No attribution required.