Ready2Order

This skill appears to do what it says (integrate with Ready2order via Membrane), but there are a few practical gaps to consider before proceeding: - The SKILL.md instructs you to install @membranehq/cli with npm (global install). That requires node/npm and will add a persistent binary; the registry metadata did not declare this dependency. Only install if you trust the upstream package and its publisher. - The Membrane login is an interactive browser auth flow and will store tokens/config locally. The skill does not document where credentials are persisted. Review Membrane's docs and local config paths before authenticating. - The Membrane proxy lets you send arbitrary HTTP requests to Ready2order on behalf of your authenticated connection. Treat the connection like a live API credential: only grant access if you trust the CLI/service and the agent invocation context. - Verify the @membranehq/cli package and the repository (https://github.com/membranedev/application-skills and the Membrane project) on npm/GitHub for legitimacy and recent activity. Prefer using the CLI in an environment you control and avoid installing global packages on sensitive machines if you are unsure. If you want a cleaner security posture, ask the skill author/registry to: declare required binaries (node/npm, membrane), add an install spec or explicit notes about config/credential storage paths, and explain where local tokens are stored and how to revoke connections.