Plasmic
v1.0.2Plasmic integration. Manage Projects. Use when the user wants to interact with Plasmic data.
⭐ 0· 126·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description (Plasmic integration) match the instructions: it uses the Membrane CLI to discover and run Plasmic-related actions and to proxy requests to Plasmic. It does not request unrelated credentials or system access.
Instruction Scope
The SKILL.md directs the agent to run Membrane CLI commands (login, connect, action list/run, request proxy). These are in-scope for a Plasmic integration, but the proxy capability allows arbitrary HTTP requests to Plasmic endpoints via Membrane — expected for this integration, but worth noting because it lets the agent send arbitrary API requests once a connection exists.
Install Mechanism
No install spec is baked into the registry bundle (instruction-only), but the instructions require installing the Membrane CLI globally via npm (npm install -g @membranehq/cli). Installing a global npm package is reasonable here but entails the usual trust and privilege considerations for third-party CLIs.
Credentials
The skill declares no required env vars or credentials. The SKILL.md explicitly advises against asking users for API keys and relies on Membrane to manage auth, which is proportionate to the stated purpose.
Persistence & Privilege
The skill is not force-included (always: false) and requests no special persistence or system-wide configuration changes. Autonomous invocation is allowed but is the platform default and not combined with other concerning privileges.
Assessment
This skill is coherent: it tells the agent to use the Membrane CLI to connect to Plasmic and run actions. Before installing or using it: 1) Verify you trust the Membrane project and the @membranehq/cli npm package (check npm and project repo and signatures if available). 2) Understand that the CLI will perform browser-based authentication and Membrane will hold/refresh credentials server-side — once a connection is made, the agent can run Plasmic API calls via Membrane's proxy. 3) Installing a global npm CLI requires elevated filesystem access for your account; consider installing in a sandbox/container if you have concerns. 4) The skill does not request API keys, but you should still review what permissions the created connector/connection gets in Plasmic and restrict scope where possible. 5) If you want extra caution, run the CLI and create the connector manually (outside the agent) and only provide the connection ID to the agent when you are comfortable with its permissions.Like a lobster shell, security has layers — review code before you run it.
latestvk973y8avfmxxe0f6pp6gm358tn842ztg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.