Newsman
v1.0.0Newsman integration. Manage data, records, and automate workflows. Use when the user wants to interact with Newsman data.
⭐ 0· 58·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description match the instructions (it uses Membrane to manage Newsman data). Minor mismatch: the SKILL.md instructs installing the @membranehq/cli via npm (and therefore implicitly requires npm/node), but the registry metadata lists no required binaries. Functionally the required tooling (network access and Membrane account) is appropriate for the described purpose.
Instruction Scope
SKILL.md confines runtime actions to using the Membrane CLI (search/connect/list/action/run/request) and the Membrane proxy for Newsman API calls. It does not instruct reading unrelated files, accessing undeclared environment variables, or transmitting data to unexpected endpoints.
Install Mechanism
Installation is via a public npm package (@membranehq/cli) invoked as a global install or via npx; this is a common pattern but has moderate risk compared to no-install instruction-only skills. There is no opaque download URL or extract step. The registry lacked an explicit install spec despite the SKILL.md recommending npm installation.
Credentials
No environment variables or credentials are declared or requested by the skill; SKILL.md explicitly delegates credential handling to Membrane (server-side). This is proportionate to the task of connecting to Newsman through a connector.
Persistence & Privilege
The skill is not always-enabled and requests no system-level persistence. It relies on the Membrane CLI and a user-authenticated connection; autonomous model invocation is allowed (platform default) but there is no unusual elevated privilege requested by the skill itself.
Scan Findings in Context
[no_code_files_to_scan] expected: The skill is instruction-only (SKILL.md only). The regex-based scanner had no code files to analyze, which is expected for an instruction-only integration.
Assessment
This skill appears coherent and uses the Membrane CLI to talk to Newsman. Before installing: (1) be prepared to allow network access and to sign in to a Membrane account (browser-based auth); (2) confirm you have npm/node if you plan to install the CLI, or use npx to avoid a global install; (3) verify the @membranehq/cli package provenance (npm page / repository) if you want additional assurance; (4) review the Membrane connection's permissions/scopes in your account before connecting—Membrane will hold the Newsman credentials and proxy requests on your behalf; (5) if you are concerned about autonomous agent actions, restrict the agent's ability to invoke skills or monitor actions the first time you use it.Like a lobster shell, security has layers — review code before you run it.
latestvk977sz1ek1aq5fssrv014ypvmx8483cy
License
MIT-0
Free to use, modify, and redistribute. No attribution required.