Questdb
v1.0.0QuestDB integration. Manage data, records, and automate workflows. Use when the user wants to interact with QuestDB data.
⭐ 0· 44·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill claims to integrate with QuestDB and the instructions use Membrane to do so — this is coherent. However, the registry metadata lists no required binaries while SKILL.md instructs installing the `@membranehq/cli` (i.e., the `membrane` binary). That mismatch is a minor bookkeeping inconsistency.
Instruction Scope
Instructions are focused on using the Membrane CLI to discover connectors, create connections, run actions, and proxy API requests to QuestDB. They do not instruct reading unrelated local files or environment secrets. Important: using Membrane's proxy means requests and data will transit (and may be processed by) Membrane's service — the SKILL.md explicitly relies on Membrane to handle auth and credential refresh.
Install Mechanism
There is no install spec in the registry (instruction-only), but SKILL.md asks users to install `npm install -g @membranehq/cli` or use npx. This is a user-driven install from the public npm registry (moderate trust surface). The skill itself does not automatically download or execute code on install.
Credentials
The skill requests no environment variables or secrets and instructs users not to ask for API keys, relying instead on browser-based Membrane authentication. That is proportionate to the stated purpose. Be aware that authentication and credentials are managed server-side by Membrane.
Persistence & Privilege
The skill is not always-enabled and is user-invocable (normal). It does not request persistent system privileges or modify other skills; no concerning persistence behavior is present in the instructions.
Scan Findings in Context
[NO_SCAN_FINDINGS] expected: The package is instruction-only with no code files, so the regex-based scanner had nothing to analyze. This is expected for an instruction-only skill.
Assessment
This skill appears to do what it says: it uses Membrane to connect to QuestDB. Before installing or following the instructions: 1) Verify the @membranehq/cli package on npm (publisher, recent versions, and popularity) or prefer running via npx to avoid a global install. 2) Understand that Membrane proxies requests and manages credentials server-side — any data you send through the proxy may be visible to Membrane, so avoid sending highly sensitive data unless you trust the service and its privacy policy. 3) Note the minor metadata mismatch: the registry didn’t declare required binaries even though the SKILL.md expects the `membrane` CLI. 4) If you need stronger guarantees, review Membrane’s docs/terms and the CLI source before use. If any of these points concern you, treat the skill cautiously or test it in an isolated environment first.Like a lobster shell, security has layers — review code before you run it.
latestvk97a14k8hfkjb0s9wcyp7c540984edab
License
MIT-0
Free to use, modify, and redistribute. No attribution required.