Gocanvas
v1.0.2GoCanvas integration. Manage Users, Roles, Organizations, Projects, Pipelines, Deals and more. Use when the user wants to interact with GoCanvas data.
⭐ 0· 94·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (GoCanvas integration) matches the instructions: all actions are performed via Membrane's CLI and proxy to the GoCanvas API. There are no unrelated credential requests or unrelated binaries referenced.
Instruction Scope
SKILL.md only instructs installing and using the Membrane CLI, creating a connection, listing actions, running actions, and using a proxy to call GoCanvas endpoints. It does not ask the agent to read unrelated files, exfiltrate data, or access environment variables beyond the described Membrane login flow. Note: the document contains a manual install/login flow (including headless guidance) so the user or operator must perform authentication in a browser or complete the code-based flow.
Install Mechanism
This is an instruction-only skill (no install spec in registry). The SKILL.md tells users to install @membranehq/cli with `npm install -g`. Installing a global npm package is a normal pattern but does write code to the host and runs third-party code from the npm registry; the package namespace (@membranehq) and homepage/repository align with the vendor. Because installation is manual (not automated by the platform), the main risk is the usual one for npm installs (confirm package authenticity and review permissions).
Credentials
No environment variables, secrets, or unrelated credentials are requested. The instructions explicitly say to let Membrane handle credentials and not to ask users for API keys, which is proportionate for a connector-based integration.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system-wide settings. It has no declared install-time persistence or privileged system access in the registry metadata.
Assessment
This skill appears to do what it says: it requires a Membrane account and the Membrane CLI to act as a proxy to GoCanvas. Before installing, verify the npm package @membranehq/cli is the official package you expect (check the publisher, download counts, and repository). Be aware that `npm install -g` installs code on your machine — only run it on hosts you control. The skill does not ask for API keys or extra environment variables; authentication happens via Membrane's browser-based login/connection flow. Finally, note that installation is manual (the registry metadata has no automated install spec), so the CLI must be installed and authenticated before use.Like a lobster shell, security has layers — review code before you run it.
latestvk97dbzpch6ae1jnh8ztdbp2nzn843jj4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.