Quaderno
v1.0.2Quaderno integration. Manage data, records, and automate workflows. Use when the user wants to interact with Quaderno data.
⭐ 0· 125·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description (Quaderno integration) match the runtime instructions (use Membrane to connect and proxy to Quaderno). However, the SKILL.md expects the Membrane CLI (installed via npm), while the registry metadata declares no required binaries — a minor mismatch in declared requirements.
Instruction Scope
Instructions are focused on installing and using the Membrane CLI to create connections, list/run actions, and proxy requests to the Quaderno API. They do not instruct reading unrelated files or exfiltrating environment variables; they explicitly advise against asking users for API keys.
Install Mechanism
There is no formal install spec in the registry; the SKILL.md tells users to run `npm install -g @membranehq/cli`. Installing a package globally from the public npm registry is common but will modify the host environment — the skill does not declare this install step in metadata.
Credentials
No environment variables or credentials are requested by the skill; authentication is delegated to Membrane via browser-based login. This is proportionate for the stated purpose, though it requires trusting Membrane to manage credentials server-side.
Persistence & Privilege
The skill is not forced-always (always:false) and uses default autonomous invocation rules. It does not request elevated or cross-skill configuration changes; the only persistent change the docs suggest is installing the Membrane CLI (user-managed).
Assessment
This skill appears to do what it claims: it uses the Membrane CLI to connect to Quaderno and proxy API calls, and it deliberately avoids asking for API keys. Before installing or using it: 1) be prepared to install a global npm package (you need node/npm and it will add a system binary); the registry metadata doesn't list npm as a required binary — verify you are comfortable installing @membranehq/cli. 2) The skill delegates credential storage to Membrane (browser login and server-side token management) — ensure you trust Membrane/getmembrane.com and the skill author. 3) Running the CLI involves opening a browser for auth or using a headless flow; verify you will not inadvertently paste secrets into the terminal when completing login. 4) Because this is instruction-only, the agent will not ship code, but the CLI you install will run on your machine — review the CLI's package and its permissions if you want higher assurance. If you need further confidence, request the skill owner to declare required binaries (node/npm) in metadata or provide an explicit install spec.Like a lobster shell, security has layers — review code before you run it.
latestvk976jc6eyprp5bs5wg2tfnfdv1843shf
License
MIT-0
Free to use, modify, and redistribute. No attribution required.