Phyllo
v1.0.0Phyllo integration. Manage data, records, and automate workflows. Use when the user wants to interact with Phyllo data.
⭐ 0· 55·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name and description (Phyllo integration) align with the instructions (use Membrane to connect to Phyllo). Minor inconsistency: the SKILL.md expects the user to install a CLI (npm/node and the 'membrane' binary), but the registry metadata lists no required binaries. That is a small documentation mismatch rather than a functional contradiction.
Instruction Scope
All runtime instructions stay within the stated purpose: installing/using the Membrane CLI, logging in, creating connections, listing actions, running actions, and proxying requests to Phyllo via Membrane. The instructions do not ask the agent to read unrelated files or environment variables, nor to send data to endpoints outside Membrane/Phyllo.
Install Mechanism
There is no automated install spec in the registry (lowest risk), but the SKILL.md tells users to run `npm install -g @membranehq/cli` or use npx. Installing a package from the public npm registry is a moderate supply-chain risk — expected for a CLI, but verify the package and publisher before installing.
Credentials
The skill declares no environment variables or credentials. It delegates auth to Membrane (browser-based login and server-side credential management), which is proportionate to the stated purpose. No unrelated secrets are requested.
Persistence & Privilege
Skill is instruction-only, not always-enabled, and does not request persistent system changes or modify other skills. The normal platform behavior (agent may invoke the skill) applies; nothing in the skill requests elevated or persistent privileges.
Assessment
This skill is essentially documentation telling you to use the Membrane CLI to access Phyllo. Before installing or using it: 1) Verify the `@membranehq/cli` npm package and the publisher (use the official site/getmembrane.com and npm package page) to avoid malicious packages. 2) Understand that authenticating via `membrane login` gives Membrane access to your Phyllo data — review Membrane's privacy/security docs and any permissions granted. 3) Be aware the Membrane proxy can make arbitrary API calls to Phyllo on behalf of the authenticated connection; only connect accounts you intend to expose to the agent. 4) The SKILL.md suggests global npm install but you can use `npx` or a local install to reduce system-wide changes. 5) If you want to limit risk, avoid enabling autonomous invocation for agents that should not access your creator data automatically, and revoke the Membrane connection when finished.Like a lobster shell, security has layers — review code before you run it.
latestvk975mfadkp9f3ebhtac931h22d84crhd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.