Holistics
v1.0.2Holistics integration. Manage data, records, and automate workflows. Use when the user wants to interact with Holistics data.
⭐ 0· 97·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Holistics integration) align with the instructions: all runtime actions are performed via the Membrane CLI which proxies requests to Holistics. Nothing in the SKILL.md requests unrelated credentials, binaries, or config paths.
Instruction Scope
Instructions are focused on installing and using the Membrane CLI, creating connections, listing actions, running actions, and proxying requests to Holistics. One important scope note: the skill explicitly routes API calls through Membrane's proxy, which means request payloads and Holistics responses will pass through Membrane's servers — this is expected for the stated design but is an important data-flow implication.
Install Mechanism
No install spec in the registry (instruction-only) but the SKILL.md tells users to install the @membranehq/cli via npm (global install) or use npx. Using npm is a common approach but carries normal npm risks (third-party code executed locally). This is not disproportionate, but users should be aware of installing a global npm package from the public registry.
Credentials
The skill declares no required environment variables or credentials and instructs the user to rely on Membrane for auth. The lack of extra env vars is proportional to the described behavior. Note: using Membrane means you must trust their service with authentication and proxied data.
Persistence & Privilege
always is false and the skill does not request persistent system privileges or modify other skills. Autonomous invocation is allowed (platform default) but not combined with other elevated privileges.
Assessment
This skill appears coherent: it uses the Membrane CLI to call Holistics rather than asking for Holistics API keys. Before installing, consider: (1) Membrane will see proxied requests and responses — review their security/privacy/compliance policies and ensure you trust that service for your data. (2) Installing @membranehq/cli globally runs third-party code on your system — prefer using npx or install in a controlled environment if you have concerns. (3) For sensitive data, consider a dedicated Membrane account with limited scope and confirm whether routing through a third party meets your organization's policies.Like a lobster shell, security has layers — review code before you run it.
latestvk97335mj8err85sxghk6cfcs9n8424fd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.