Murlist
v1.0.2MurList integration. Manage Organizations. Use when the user wants to interact with MurList data.
⭐ 0· 120·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description say 'MurList integration' and the SKILL.md exclusively describes using the Membrane CLI to discover connectors, create connections, run actions, and proxy API requests to MurList — exactly what you would expect for this integration.
Instruction Scope
Instructions tell the agent to install and run the Membrane CLI, perform login flows, enumerate actions, run actions, and proxy arbitrary MurList API calls through Membrane. This is within the feature scope, but gives the agent the ability to issue arbitrary proxied requests to the connected account (expected for a connector but wide in practice).
Install Mechanism
The SKILL.md recommends installing @membranehq/cli via npm (global install). Using an npm package from the public registry is a standard approach but is a non-trivial change to the host (global installs require permission). No downloads from untrusted URLs or archives are recommended.
Credentials
The skill declares no environment variables or secrets and explicitly instructs not to ask users for API keys. It relies on Membrane-managed connections/authentication, which is proportional to its stated purpose.
Persistence & Privilege
The skill is instruction-only, does not request always:true, and doesn't modify other skills or system-wide settings. It does require the CLI to be installed at runtime but does not ask for persistent elevated privileges in the manifest.
Assessment
This skill appears to do what it says: use the Membrane CLI to talk to MurList. Before installing or running commands: (1) verify the @membranehq/cli package and its repository on npm/GitHub to ensure you trust the maintainer; (2) be aware a global npm install modifies the host and may require elevated permissions; (3) understand that once a connection is created, actions or free-form proxied requests can access your MurList data — only run actions/requests you trust and review returned action IDs/input schemas before executing; (4) prefer using Membrane-managed connections as recommended rather than sharing API keys. If you want extra assurance, inspect the Membrane CLI source code or run it in a controlled environment (container/VM) before granting it access to your account.Like a lobster shell, security has layers — review code before you run it.
latestvk974c108bx1b5rj5hjsg36v92x84387w
License
MIT-0
Free to use, modify, and redistribute. No attribution required.