Kombo
v1.0.2Kombo integration. Manage data, records, and automate workflows. Use when the user wants to interact with Kombo data.
⭐ 0· 77·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Kombo integration) aligns with the instructions: all runtime steps use the Membrane CLI to discover connectors, create connections, run actions, and proxy requests to Kombo. No unrelated credentials or tools are requested.
Instruction Scope
Instructions are explicit and limited to installing/using the Membrane CLI, authenticating via browser, listing/connecting to connectors, running actions, and proxying API requests. This gives the agent the ability to send arbitrary proxied requests (and request bodies) through Membrane, so data forwarded to Kombo/third parties will transit Membrane's servers — expected for this integration but worth noting for privacy.
Install Mechanism
No install spec in the skill bundle, but the SKILL.md instructs global npm installation (npm install -g @membranehq/cli) and shows npx usage. Installing an npm package is a standard, moderate-risk step; it modifies the system PATH/global packages and will fetch code from the npm registry at install time.
Credentials
The skill does not request environment variables, secrets, or unrelated credentials. The documentation explicitly instructs to let Membrane handle auth instead of asking for API keys, which is proportionate for a connector-based integration.
Persistence & Privilege
The skill does not declare always:true, has no install spec writing files itself, and does not request elevated or cross-skill configuration. Autonomous invocation is allowed by default (platform behavior) but not combined with other concerning privileges here.
Assessment
This skill appears internally consistent: it tells you to install and use the Membrane CLI to connect to Kombo, authenticate via a browser flow, and run or proxy API calls. Before installing or using it, consider: (1) installing the CLI will add a global npm package to your system — only do this if you trust @membranehq on the npm registry; (2) all proxied requests and credentials are handled by Membrane's servers, so any data you send through the CLI will transit that service — confirm you trust getmembrane.com / Membrane and their privacy/security practices; (3) the CLI examples include npx usage which fetches code at runtime — prefer pinning a vetted version if you need stability. If you are comfortable trusting Membrane as the broker for Kombo access, the skill is coherent with its purpose.Like a lobster shell, security has layers — review code before you run it.
latestvk97c0vmp3rndmb4ezqj222yb85842chb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.