Punchh
v1.0.0Punchh integration. Manage data, records, and automate workflows. Use when the user wants to interact with Punchh data.
⭐ 0· 61·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name and description claim a Punchh integration and the SKILL.md exclusively instructs using the Membrane CLI and Membrane connections/proxy to interact with Punchh. Required capabilities (network + Membrane account and installing @membranehq/cli) are proportional and expected for this purpose.
Instruction Scope
Runtime instructions are focused on installing and using the Membrane CLI, creating connections, listing actions, running actions, and proxying requests to the Punchh API. The instructions do not ask the agent to read unrelated files, pull other credentials, or exfiltrate data outside the Membrane/Punchh flows.
Install Mechanism
The instructions ask users to install the Membrane CLI via npm (npm install -g @membranehq/cli). This is a standard public-registry install (moderate trust), but it does install a global binary on the host — users with strict policies about global npm installs should consider using npx or reviewing the package first.
Credentials
The skill declares no required env vars or local credentials. It relies on a Membrane account and browser-based login flows; Membrane is responsible for storing and refreshing service credentials, which is appropriate for the described integration. Users should be aware that Membrane (the third-party service) will have access to Punchh credentials and proxied data.
Persistence & Privilege
The skill is instruction-only, does not request always:true, and does not modify other skills or system-wide agent settings. CLI installation will persist a binary on disk if performed, which is expected for this workflow.
Assessment
This skill appears to do what it claims: it directs you to install the official Membrane CLI and use Membrane to connect to Punchh. Before installing, consider: (1) trust and privacy — Membrane will hold and proxy your Punchh credentials/data, so review their security/privacy policies; (2) system policy — the npm -g install writes a global binary (use npx if you prefer not to install globally); (3) interactive auth — the login flow opens a browser or requires manual code completion in headless environments. If those points are acceptable, the skill is coherent and proportionate for integrating with Punchh.Like a lobster shell, security has layers — review code before you run it.
latestvk97afnwan6k7w001m7y1fe2eqx84bk6f
License
MIT-0
Free to use, modify, and redistribute. No attribution required.