Productboard
v1.0.2Productboard integration. Manage data, records, and automate workflows. Use when the user wants to interact with Productboard data.
⭐ 0· 58·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill claims to integrate with Productboard and the SKILL.md uses the Membrane CLI to do so, which is a coherent approach. However the manifest declares no required binaries or environment but the instructions implicitly require Node/npm (to install @membranehq/cli), a web browser for OIDC login, network access, and a Membrane account/tenant. Those implicit requirements should be declared.
Instruction Scope
The runtime instructions stick to Productboard-related operations via Membrane: installing the CLI, logging in, creating connections, listing actions, running actions, and proxying API requests. They do not ask the agent to read unrelated files, request unrelated credentials, or exfiltrate data to unexpected endpoints.
Install Mechanism
There is no registry install spec, but the SKILL.md instructs users to run a global npm install (npm install -g @membranehq/cli). Installing a global npm package is a common pattern but does execute third‑party code from the npm registry; the skill should have declared this installer requirement so users can review the package source (npm/GitHub) before running it.
Credentials
The skill declares no required environment variables or credentials and advises using Membrane to handle auth rather than asking for API keys, which is proportionate. There are no requests for unrelated secrets or multiple unrelated credentials.
Persistence & Privilege
The skill is instruction-only, does not request always:true, and does not modify other skills or system-wide settings. Autonomous invocation is enabled by default (disable-model-invocation=false) which is normal for skills and not by itself a concern.
Assessment
This skill appears to do what it says: it uses the Membrane CLI to interact with Productboard. Before installing or running it: (1) verify the @membranehq/cli package on npm and its GitHub repo (ensure the package and maintainer are trusted), (2) be prepared to install a global npm binary (requires Node/npm) and perform browser-based login to a Membrane account/tenant, (3) avoid running these steps on machines with sensitive credentials or in locked-down environments until you trust the CLI, and (4) confirm network access to Membrane and Productboard is acceptable for your environment. The skill itself does not ask you to provide Productboard API keys (it delegates auth to Membrane), but you should still review Membrane's privacy/security docs and the CLI source if you need higher assurance.Like a lobster shell, security has layers — review code before you run it.
latestvk978xqxxqw92pq17496p31qhah843fam
License
MIT-0
Free to use, modify, and redistribute. No attribution required.