Moco
v1.0.2MOCO integration. Manage Organizations. Use when the user wants to interact with MOCO data.
⭐ 0· 126·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (MOCO integration) match the instructions (use Membrane to talk to MOCO). Required capabilities (network access and a Membrane account) are appropriate for the stated purpose.
Instruction Scope
SKILL.md confines runtime actions to installing/using the Membrane CLI, creating connections, listing actions, running actions, or proxying requests to the MOCO API. It does not instruct reading unrelated files, environment variables, or posting data to endpoints outside Membrane/MOCO.
Install Mechanism
The skill is instruction-only (no install spec) but instructs users to run `npm install -g @membranehq/cli` (or use npx). Installing a global npm CLI writes code to disk and adds a binary; this is expected for a CLI-based integration but is not declared in a formal install spec. The package comes from the npm registry (moderate risk only if the package/org is untrusted).
Credentials
The skill declares no required environment variables or credentials and explicitly recommends letting Membrane manage auth. Requesting a Membrane account and network access is proportionate for the task; no unrelated secrets or config paths are asked for.
Persistence & Privilege
Skill does not request always:true and makes no claims about modifying other skills or system-wide config. Autonomous invocation is allowed by default (platform behavior) but this skill's scope is limited to Membrane CLI operations.
Assessment
This skill appears coherent, but note a few practical things before installing: (1) the README recommends installing @membranehq/cli via npm (global install will write binaries and may require elevated permissions) — consider using npx if you prefer not to install globally; (2) because this is instruction-only, there is no packaged install spec or contained code for reviewers to scan — verify the npm package and its repository (@membranehq) yourself before trusting it; (3) the integration relies on your Membrane account and delegates MOCO credentials to Membrane — only proceed if you trust Membrane to manage those credentials; (4) if you are concerned about an agent autonomously invoking the skill to access MOCO data, keep it user-invocable only (do not enable any platform-level always:true behavior).Like a lobster shell, security has layers — review code before you run it.
latestvk9753m1qqpw8jb2f99ey4hfhe5842yjq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.