Kooomo
v1.0.0Kooomo integration. Manage data, records, and automate workflows. Use when the user wants to interact with Kooomo data.
⭐ 0· 33·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name and description claim a Kooomo integration and the runtime instructions consistently show how to use the Membrane CLI to connect to a Kooomo connector, discover actions, run actions, and proxy requests. The requested operations align with the stated purpose.
Instruction Scope
The SKILL.md stays on topic (install CLI, login, create connections, list actions, run actions, and proxy requests). It does not instruct reading unrelated files or environment variables. Important operational detail: it directs calls through Membrane's proxy and states Membrane manages authentication server-side, so Kooomo traffic and credentials (and possibly request/response data) will flow through Membrane's service — a privacy/security consideration the user should be aware of.
Install Mechanism
This is an instruction-only skill (no install spec), yet it tells the user to run `npm install -g @membranehq/cli`. Installing a global npm CLI will download and run third‑party code (moderate risk). The registry did not provide an automated install spec — installation is manual and thus lower automation risk, but users should verify the package publisher and consider using `npx` or a sandboxed environment instead of a global install.
Credentials
The skill declares no required environment variables or credentials. That is proportionate. Note: the described design intentionally avoids asking for API keys by relying on Membrane-managed connections; this centralizes credentials on Membrane's service, which is coherent but may be undesirable if you do not want a third party to hold or proxy your storefront data.
Persistence & Privilege
The skill does not request persistent 'always' inclusion and does not ask to modify other skills or system-wide configs. It is user-invocable and allows autonomous invocation (platform default), which is normal for skills.
Assessment
This skill appears to do what it says: it uses the Membrane CLI to interact with Kooomo. Before installing or using it, consider: 1) Trust and privacy — Membrane's service will proxy requests and manage credentials, so your store data and auth flows will pass through their servers; review their security/privacy docs and your organization's policy. 2) Package provenance — the SKILL.md asks you to run `npm install -g @membranehq/cli`; confirm the npm package and GitHub repo ownership, or use `npx @membranehq/cli@latest` to avoid a global install. 3) Least privilege and sandboxing — install/run the CLI in a controlled environment (container/VM) if you are unsure. 4) Do not hand over Kooomo API keys to unknown parties; follow the described connection flow rather than pasting credentials into chat. If you want stronger assurance, ask the skill author for a signed package URL, official docs for the Membrane connector, or run an audit of the npm package source before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk9792rrnkbj0gh7c0p02x6vpkh8476h5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.