Kindful
v1.0.2Kindful integration. Manage data, records, and automate workflows. Use when the user wants to interact with Kindful data.
⭐ 0· 48·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (Kindful integration) match the instructions: all actions are performed via the Membrane CLI and Membrane's Kindful connector. There are no unrelated credentials, binaries, or paths requested.
Instruction Scope
SKILL.md limits work to installing/using the Membrane CLI, creating a connection, listing actions, running actions, and proxying requests to Kindful. It does not instruct the agent to read unrelated files, access unrelated environment variables, or send data to unexpected endpoints.
Install Mechanism
There is no formal install spec in the skill bundle (it's instruction-only), but the README instructs users to run `npm install -g @membranehq/cli` (or use npx in examples). Global npm installs execute code from the npm registry and are a moderate-risk operation if the package origin is not verified; this is expected for a CLI-based integration but the skill does not provide a pinned release or checksum.
Credentials
The skill requests no environment variables or secrets. It explicitly instructs users not to provide Kindful API keys and to rely on Membrane for auth. The requested permissions (browser login, Membrane account) are proportionate to the described functionality.
Persistence & Privilege
Skill is instruction-only, has no always:true, and does not request persistent agent privileges. The only persistent change it suggests is installing the Membrane CLI (a normal user-level tool install), which is proportional to the task.
Assessment
This skill is coherent: it instructs you to use the Membrane CLI to manage Kindful data rather than handling API keys locally. Before installing, verify you trust Membrane (getmembrane.com/@membranehq) because authentication and proxied requests will transit their service. Consider using npx (as shown in examples) to avoid a global npm install, or review the @membranehq/cli package and its npm publisher before running `npm -g`. Confirm what scope/permissions the Kindful connector requests in the browser auth flow, and ensure compliance with your organization's data-handling rules for donor data. If you need stronger assurance, review Membrane's privacy/security docs and the CLI source in the linked repository before proceeding.Like a lobster shell, security has layers — review code before you run it.
latestvk9775z4hyj4k034z0q0m4hp6v1843f4x
License
MIT-0
Free to use, modify, and redistribute. No attribution required.