Marketplacer
v1.0.2Marketplacer integration. Manage Marketplaces. Use when the user wants to interact with Marketplacer data.
⭐ 0· 119·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Marketplacer integration) matches the instructions: discover actions, create connections, run actions, and proxy requests to the Marketplacer API via Membrane. Nothing asked for (no env vars, no unrelated binaries) is inconsistent with a Marketplace integration.
Instruction Scope
All runtime instructions are limited to installing and using the Membrane CLI, logging in, creating/listing Membrane connections, running actions, and proxying requests. The docs explicitly direct requests through Membrane (a third-party proxy), so users should be aware that Marketplace API requests and their payloads will be routed via Membrane's servers — this is expected behavior for the described design but is a privacy/third-party-data consideration rather than scope creep.
Install Mechanism
There is no automated install spec in the skill bundle (instruction-only). The SKILL.md tells users to install the Membrane CLI with `npm install -g @membranehq/cli` (or use npx in examples). Asking the user to install a widely-published CLI via npm is reasonable for this integration, but global npm installs carry the usual supply-chain considerations; the skill itself does not embed or download arbitrary code.
Credentials
The skill requests no environment variables or credentials and explicitly instructs to let Membrane handle credentials (do not ask users for API keys). This is proportional. The caveat: because Membrane manages auth server-side, you must trust Membrane with any data and tokens used for Marketplacer access.
Persistence & Privilege
The skill is not always-on and is user-invocable; it does not request persistent agent-level privileges or modify other skills' config. Autonomous invocation is permitted by platform default but does not present additional incoherence here.
Assessment
This skill is instruction-only and coherent with its purpose, but before installing or using it: 1) Verify you trust Membrane (https://getmembrane.com) because API calls and auth are proxied through their service and sensitive data will transit their systems. 2) Prefer running via npx or reviewing the @membranehq/cli npm package and its GitHub repo before doing a global npm install; check maintainers and recent releases. 3) If you need stronger isolation, perform initial tests in a sandboxed environment. 4) Do not supply Marketplacer API keys locally — follow the skill's guidance to create a Membrane connection so credentials are managed server-side. 5) If you need assurance about data handling or retention, review Membrane's privacy/security docs or contact them before using the integration.Like a lobster shell, security has layers — review code before you run it.
latestvk97d9z7hjdqe0hv9xp63144zxd8433hm
License
MIT-0
Free to use, modify, and redistribute. No attribution required.