Hotjar
v1.0.2Hotjar integration. Manage data, records, and automate workflows. Use when the user wants to interact with Hotjar data.
⭐ 0· 131·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The SKILL.md describes a Hotjar integration implemented via Membrane (action list/run and proxy requests). The described requirements (Hotjar data operations) align with using a connector/proxy service like Membrane.
Instruction Scope
Instructions stay within the integration scope (install Membrane CLI, login, create connections, run actions, proxy Hotjar API requests). They do not ask the agent to read arbitrary files or unrelated env vars. Note: SKILL.md implicitly routes all Hotjar requests through Membrane's servers — users should be aware that API calls and credentials are handled by that third party.
Install Mechanism
This is an instruction-only skill (no automated install). SKILL.md tells users to run `npm install -g @membranehq/cli` (global install) and also uses `npx` in examples. The registry metadata did not declare required binaries or an install spec, which is a documentation gap. Installing a public npm CLI has normal supply-chain risks; the package source should be verified.
Credentials
The skill does not request any environment variables or unrelated credentials. It explicitly instructs to avoid asking users for API keys and to let Membrane manage auth. That is proportionate, though it implies handing auth to Membrane's service.
Persistence & Privilege
always:false and no special system config or cross-skill modifications. The skill does not request persistent elevated presence. Agent-autonomous invocation is allowed (platform default) but not otherwise privileged by this skill.
Assessment
This skill is a set of instructions for using the Membrane CLI to access Hotjar data rather than embedding Hotjar API calls itself. Before using it: 1) Understand that authentication and API traffic are routed through Membrane (getmembrane.com) — review their privacy/security policy and ensure you're comfortable letting a third party broker access to your Hotjar data. 2) The README tells you to globally install @membranehq/cli via npm; verify the npm package identity (publisher, package page, and repository) before installing and consider using npx to avoid a global install. 3) The registry metadata doesn't declare the CLI as a required binary — expect to install the CLI yourself. 4) If you need stricter data controls, prefer native Hotjar integrations or using your own tooling that keeps credentials under your control. If you want, share the exact npm package link or Membrane account details and I can point out what to check on the package/repo pages.Like a lobster shell, security has layers — review code before you run it.
latestvk97867nb055arvkshs0cgmb6sx843frz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.