Goodbits
v1.0.2Goodbits integration. Manage Organizations, Leads, Projects, Users. Use when the user wants to interact with Goodbits data.
⭐ 0· 103·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description (Goodbits integration) matches the instructions (use Membrane to manage Goodbits resources). However, the SKILL.md tells users to install the Membrane CLI with npm (requiring node/npm) but the skill metadata lists no required binaries — a minor inconsistency in declared runtime requirements.
Instruction Scope
Instructions are scoped to using the Membrane CLI to create connections, run actions, and proxy requests to the Goodbits API. They do not instruct reading arbitrary host files, environment variables, or uploading unrelated data. Authentication is browser-based via Membrane; the skill explicitly advises not to request raw API keys from users.
Install Mechanism
There is no formal install spec in the skill package; instead SKILL.md instructs installing @membranehq/cli globally via npm. Installing a global npm package is a common workflow but has moderate risk compared to a purely instruction-only skill because it executes code fetched from the npm registry. The skill does not declare the need for npm/node in metadata.
Credentials
The skill declares no required environment variables or credentials. SKILL.md defers auth to Membrane and recommends not collecting API keys locally, which is proportionate for a connector to Goodbits.
Persistence & Privilege
The skill does not request always:true and does not attempt to modify other skills or system-wide configuration in the instructions. Autonomous invocation is allowed (platform default) but this is not combined with broad credential access.
Assessment
This skill appears coherent: it uses Membrane as a proxy to Goodbits and does not ask for unrelated credentials. Before installing, confirm you are comfortable installing a global npm package (@membranehq/cli) and that you have node/npm available (the skill metadata did not list these). Verify the @membranehq/cli package and the getmembrane.com and GitHub repository reputations (check npm package page, GitHub repo, recent releases, and maintainers). Do not paste Goodbits API keys into this skill — follow the Membrane browser-based login flow. Because the skill is instruction-only, there is no code to scan here; the main risk comes from the external CLI you will install, so review its permissions and README before proceeding.Like a lobster shell, security has layers — review code before you run it.
latestvk974e23x43gf9cmgqjve1xs56s8427v4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.