Mctime
v1.0.2McTime integration. Manage TimeSheets, Projects, Clients, Users. Use when the user wants to interact with McTime data.
⭐ 0· 93·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (McTime integration for timesheets, projects, users) matches the instructions, which exclusively show how to use the Membrane CLI to connect to McTime and run actions or proxied API requests. No unrelated services, credentials, or system-level access are requested.
Instruction Scope
SKILL.md confines runtime behavior to installing/using the Membrane CLI, creating a Membrane connection, listing/running actions, and optionally proxying requests to the McTime API. It does not instruct reading local files, accessing unrelated env vars, or sending data to unexpected endpoints outside the Membrane/McTime flow. Note: the 'membrane request' proxy lets you call arbitrary McTime endpoints via the connection—this is expected but means connector permissions determine what can be accessed.
Install Mechanism
This is an instruction-only skill (no automatic install). It tells users to run npm install -g @membranehq/cli or use npx. That is proportionate for a CLI-driven integration, but installing global npm packages executes third-party code—users should verify the @membranehq/cli package and trust the Membrane project before installing.
Credentials
The skill declares no required env vars or credentials and delegates auth to Membrane (the doc explicitly advises not to ask users for API keys). This is proportionate: Membrane handles authentication and token refresh server-side. The SKILL.md does state a Membrane account is required, which is appropriate and consistent.
Persistence & Privilege
The skill does not request always:true, does not declare system config paths, and is user-invocable only. Autonomous invocation is allowed by platform default but is not combined with elevated privileges or persistent presence in this skill.
Assessment
This skill appears to do what it says: it instructs you to install and use the Membrane CLI to connect to McTime. Before installing or running commands: 1) verify you trust Membrane (@membranehq/cli) and review that npm package's source and permissions; 2) confirm the Membrane connector's scopes before authorizing it to your McTime account (the connector can proxy arbitrary McTime API calls); 3) avoid running commands from unknown third-party instructions and prefer using npx for one-off calls if you don't want a global install. If you need stricter control, inspect Membrane's docs and the connector permissions first.Like a lobster shell, security has layers — review code before you run it.
latestvk974c1f3j54fnpdr7j2440hszx842htr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.