Pickrr
v1.0.0Pickrr integration. Manage data, records, and automate workflows. Use when the user wants to interact with Pickrr data.
⭐ 0· 31·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (Pickrr integration) match the instructions: the skill tells the agent to use the Membrane CLI to connect to Pickrr, list actions, run actions, and proxy API requests. No requested credentials or unrelated services are present.
Instruction Scope
SKILL.md stays on-purpose (install Membrane CLI, login, create a connector, run actions, proxy requests). Minor inconsistency: the registry metadata lists 'required binaries: none' but the instructions assume npm/node (for `npm install -g` and `npx`) and a browser for interactive login. Also the doc suggests running `npx ...@latest`, which pulls code from the npm registry at runtime.
Install Mechanism
There is no packaged install spec in the registry (instruction-only), but the README recommends installing @membranehq/cli via npm (global install) or running via npx. Installing/running an npm package is a standard but moderate-risk action because it executes remote code—verify the package source before installing.
Credentials
No environment variables, secrets, or config paths are requested by the skill. The SKILL.md explicitly states Membrane manages credentials and recommends not asking users for API keys, which is proportionate for this integration.
Persistence & Privilege
The skill is not set to always: true and does not request elevated or persistent system-wide privileges. It relies on interactive authentication via Membrane; autonomous invocation remains the platform default but is not combined with broad credential requests here.
Assessment
This skill appears coherent and uses Membrane to handle Pickrr auth and API calls. Before installing or running commands: 1) confirm you trust the @membranehq/cli package and review its npm/GitHub repo (installing with npm or running npx executes remote code); 2) be aware the SKILL.md assumes you have node/npm and a browser for login even though the registry lists no required binaries; 3) when you create a connection, the agent (or CLI) will be able to act on Pickrr data via your account—limit use to non-production data or least-privilege accounts until you’re comfortable; and 4) if you need higher assurance, inspect the Membrane CLI source and package release provenance before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97cqpa1xytwsnp3sjgwg0pc99849dr4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.