Judgeme
v1.0.2Judge.me integration. Manage Reviews, Products. Use when the user wants to interact with Judge.me data.
⭐ 0· 108·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name and description (Judge.me integration) align with its instructions: it tells the agent to use the Membrane CLI to connect to Judge.me, discover actions, run actions, and proxy requests. Nothing requested in the SKILL.md is unrelated to integrating with Judge.me.
Instruction Scope
SKILL.md only instructs installing/using the Membrane CLI, logging in, creating/listing connections, running Membrane actions, and proxying to the Judge.me API. It does not request reading unrelated files, scanning system credentials, or exfiltrating data outside of Membrane/Judge.me flows.
Install Mechanism
The registry has no install spec, but the runtime instructions tell users to run `npm install -g @membranehq/cli`. Installing a global npm package is expected for this workflow but is a moderate-risk action (you are trusting the npm package publisher). The skill itself does not auto-install anything.
Credentials
The skill requests no environment variables or local credentials and delegates all auth to Membrane. This is proportional to the purpose, but it centralizes trust: using the skill requires you to trust Membrane with Judge.me access and any data passing through it.
Persistence & Privilege
The skill is not always-enabled, does not request elevated/system-wide persistence, and does not modify other skills or system configs. Autonomous invocation is allowed by default (normal for skills) but not combined with other concerning privileges.
Scan Findings in Context
[no-findings] expected: No code files were present for regex scanning; SKILL.md is instruction-only, so the scanner had nothing to analyze.
Assessment
This skill appears coherent: it instructs the agent to use the Membrane CLI to access Judge.me and does not ask for unrelated credentials or files. Before installing, confirm you trust Membrane (the npm package @membranehq/cli and the Membrane service) because Membrane will hold and proxy your Judge.me credentials and see the data. Prefer installing the CLI from the official publisher, review the package and repository (https://github.com/membranedev/application-skills), and read Membrane's privacy/security docs. If you want to avoid third-party access, consider using your own Judge.me API keys directly (outside of Membrane) or run the CLI in a dedicated environment. Finally, be aware that `npm install -g` modifies your system global packages—use a managed environment if that concerns you.Like a lobster shell, security has layers — review code before you run it.
latestvk9754a3h2qfrvcv2372ac3ssmx842v5s
License
MIT-0
Free to use, modify, and redistribute. No attribution required.