Mainstay
v1.0.2Mainstay integration. Manage data, records, and automate workflows. Use when the user wants to interact with Mainstay data.
⭐ 0· 75·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description (Mainstay integration) matches the runtime instructions which rely on the Membrane CLI to access Mainstay. Minor metadata omission: the registry metadata lists no required binaries, but SKILL.md clearly requires the 'membrane' CLI (installed via npm). This is a documentation/packaging inconsistency but not a functional mismatch.
Instruction Scope
SKILL.md confines actions to installing/using the Membrane CLI, creating/listing connections, running actions, and proxying requests to Mainstay via Membrane. It does not instruct reading unrelated files or environment variables. It explicitly advises against asking users for API keys and delegates auth to Membrane. Note: proxying API calls means request payloads (potentially PII/files) will flow through Membrane services.
Install Mechanism
There is no automated install spec; instead the doc instructs manual installation via 'npm install -g @membranehq/cli' or using 'npx'. Installing a global npm package is a common but non-trivial operation (writes to disk, modifies PATH). The package comes from the public npm registry (moderate trust surface).
Credentials
The skill declares no required environment variables or credentials and the instructions rely on Membrane to manage auth server-side. This is proportionate to the stated purpose. Be aware that using Membrane hands auth tokens and proxied request contents to the Membrane service rather than keeping them purely local.
Persistence & Privilege
The skill is not always-enabled and does not request persistent elevated privileges or modify other skills' configs. Autonomous model invocation is allowed (platform default) but not combined with other concerning privileges.
Assessment
This skill appears to do what it says: it uses the Membrane CLI to access Mainstay. Before installing/use consider: (1) Membrane will proxy API calls and store/manage credentials server-side—do you trust that service with your data and tokens? (2) The instructions ask you to install a global npm package (writes to disk/affects PATH); prefer using 'npx' or a sandbox if you want less system impact. (3) Verify the @membranehq/cli package and the linked repository/homepage yourself, and complete interactive login steps in a secure browser. If you don't want your Mainstay data routed through a third party, do not use this skill.Like a lobster shell, security has layers — review code before you run it.
latestvk976y5hhrqhrf0hdgx734zrwmx842njc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.