Neuronwriter
v1.0.2NEURONWriter integration. Manage Projects, Users. Use when the user wants to interact with NEURONWriter data.
⭐ 0· 64·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill's name and description match the instructions: it uses the Membrane CLI to interact with NEURONWriter. However, the registry metadata declares no required binaries while the SKILL.md explicitly instructs installing the `@membranehq/cli` (via `npm install -g`) and using the `membrane` command — a small mismatch between declared requirements and runtime instructions.
Instruction Scope
Instructions are focused on discovering connections, listing actions, running actions, and proxying requests to the NEURONWriter API via Membrane. This is coherent for an integration skill. One thing to note: the `membrane request CONNECTION_ID /path/to/endpoint` capability lets the agent send arbitrary proxied HTTP requests to the upstream API, which is powerful and could be used to fetch or send arbitrary data if misused. The SKILL.md does not instruct reading unrelated local files or environment variables.
Install Mechanism
This is an instruction-only skill (no install spec in metadata), but SKILL.md tells users to install `@membranehq/cli` globally via npm. Installing a third-party CLI from npm is a moderate-risk action compared with zero-install instruction-only skills; the package is traceable (membranehq) but the skill does not include a formal install block in the registry metadata.
Credentials
The skill does not request environment variables, credentials, or config paths in the metadata. Authentication is delegated to Membrane (browser login / connection flow), which avoids local API keys. This is proportional for a connector-based integration.
Persistence & Privilege
The skill does not request always:true or other elevated persistent privileges, and does not claim to modify other skills or system-wide settings. Autonomous invocation is allowed (platform default) but not combined with other high-risk privileges.
Assessment
This skill appears to do what it says: it uses the Membrane CLI to talk to NEURONWriter. Before installing, verify the @membranehq/cli package (check the npm package page and upstream repo), and prefer using npx or installing in a controlled environment if you have concerns about global npm installs. Be aware the skill allows sending arbitrary proxied HTTP requests via your Membrane connection — ensure you trust the Membrane account and the connections you create (limit which connectors the account can access). Also note the small metadata mismatch: the SKILL.md requires the `membrane` CLI but the registry metadata lists no required binaries. If you need higher assurance, ask the publisher for a verified source/origin for the CLI and the connector, or run the CLI in an isolated environment or container.Like a lobster shell, security has layers — review code before you run it.
latestvk97605fcbmphjvcysa6401fva9842w2x
License
MIT-0
Free to use, modify, and redistribute. No attribution required.