Puppet
v1.0.0Puppet integration. Manage data, records, and automate workflows. Use when the user wants to interact with Puppet data.
⭐ 0· 60·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Puppet integration) matches the instructions: all runtime steps describe using the Membrane CLI to connect to Puppet, list/run actions, and proxy API requests. Homepage/repository references are to Membrane, which is consistent with the described integration. No unrelated binaries or env vars are requested.
Instruction Scope
SKILL.md is instruction-only and confines activity to installing/using the Membrane CLI, performing OIDC/browser login flows, creating/using a Puppet connection, running predefined actions, or proxying Puppet API calls through Membrane. This stays within the stated purpose, but proxying allows arbitrary Puppet API requests to be sent via Membrane — so puppet data and API payloads will transit Membrane's service.
Install Mechanism
There is no automated install spec in the skill bundle, but the guide instructs users to run `npm install -g @membranehq/cli` (or npx) to get the CLI. Installing a scoped npm package globally is a common pattern and appropriate for a CLI, but global npm installs execute code from the package registry and should be reviewed/installed intentionally.
Credentials
The skill requests no environment variables or local config paths (consistent). It does require a Membrane account and network access. Important: authentication and Puppet API requests are routed via Membrane, so any Puppet data you proxy will be visible to the Membrane service — this is expected for this integration but relevant for sensitive on-prem/private data.
Persistence & Privilege
The skill is not always-included, has no install-time persistence, and does not modify other skills or system-wide settings. disable-model-invocation is false (agent may call the skill autonomously) which is the platform default and not by itself a concern.
Assessment
This skill is coherent: it instructs using the official-seeming Membrane CLI to connect to Puppet. Before installing/use: 1) Confirm you trust Membrane (https://getmembrane.com and the @membranehq npm package) because API requests and data will flow through their service; 2) Audit or pin the CLI package version before doing a global npm install (global npm installs run package code); 3) For highly sensitive, internal Puppet systems, consider whether sending requests through a third-party proxy is acceptable — if not, use direct, local tooling instead; 4) Be aware the login flow stores credentials/tokens for the CLI — check where tokens are persisted and secure that storage. If you need more assurance, ask for the package source/release tags or run the CLI in an isolated environment first.Like a lobster shell, security has layers — review code before you run it.
latestvk976g777ajw75k2bx7k2c0exyd84ehew
License
MIT-0
Free to use, modify, and redistribute. No attribution required.