Helloleads

• Risk level: Low
• Analyzed: Apr 2, 2026, 10:50 PM
• Findings: 0
• Version: 1.0.2

Overview

The skill's instructions and requirements are internally consistent with a HelloLeads integration that uses the Membrane CLI, with a few implementation notes (npx usage and an unstated credentials path) worth reviewing before installation.

This skill appears to do what it says: it uses the Membrane CLI to interact with HelloLeads. Before installing or running it, consider the following: (1) npx @membranehq/cli@latest will fetch and execute code from npm each time — ensure you trust the @membranehq package and the npm registry. (2) The CLI stores credentials in ~/.membrane/credentials.json; check and control access to that file if you handle sensitive data. (3) The proxy command can accept full URLs, so avoid sending sensitive data to untrusted endpoints through the proxy. If you're comfortable trusting Membrane and you expect to authenticate via browser flow, the skill is proportionate to its purpose. If you need higher assurance, review the Membrane CLI source and verify the package publisher before use.