Porter
v1.0.0Porter integration. Manage data, records, and automate workflows. Use when the user wants to interact with Porter data.
⭐ 0· 55·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Porter integration) match the instructions: the SKILL.md tells the agent to use the Membrane CLI to discover connectors, create a Porter connection, run actions, and proxy API requests. Required capabilities (network, Membrane account) are appropriate for the stated purpose.
Instruction Scope
Runtime instructions are limited to installing/using the Membrane CLI, logging in, creating/listing connections, running actions, and proxying requests to the Porter API. The instructions do not request unrelated files, system credentials, or unspecified data exfiltration. They do direct requests to external services (Membrane/Porter) as expected for an integration.
Install Mechanism
No install spec in the package itself (instruction-only). The SKILL.md recommends installing @membranehq/cli via npm -g (a public npm package). This is a reasonable, common choice for a CLI, but global npm installs carry supply-chain and permission considerations—examples in the doc also use npx which avoids a global install.
Credentials
The skill declares no required environment variables, no primary credential, and no config paths. The SKILL.md explicitly advises letting Membrane handle credentials and not asking users for API keys, which is proportionate for this integration.
Persistence & Privilege
The skill does not request always:true and is not asking to modify other skills or system-wide settings. Default autonomous invocation is allowed by platform policy but not leveraged here in a way that requires special scrutiny.
Assessment
This skill is coherent and appears to do what it says: use the Membrane CLI to interact with Porter. Before installing:
- Prefer running actions via npx or a local install instead of npm -g to reduce global install/supply-chain risk (the docs already use npx in examples).
- Verify the @membranehq/cli package and its GitHub repo (ownership, recent releases, and maintainer reputation) before installing.
- Understand that Membrane will act as a proxy and will have access to the Porter account data you connect; only authorize connections you trust and check which Membrane tenant you log into.
- Avoid pasting tokens or sensitive credentials in public contexts; follow the headless login flow described to keep secrets out of chat.
If you want deeper assurance, request the exact Membrane CLI package checksum or a link to the specific repository/release used by this skill and verify it independently.Like a lobster shell, security has layers — review code before you run it.
latestvk979eg9vrkxbkms0csbgy48wbn84cm95
License
MIT-0
Free to use, modify, and redistribute. No attribution required.