Referralhero
v1.0.2ReferralHero integration. Manage data, records, and automate workflows. Use when the user wants to interact with ReferralHero data.
⭐ 0· 107·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill declares ReferralHero integration and the SKILL.md consistently instructs use of the Membrane CLI and a Membrane account to manage ReferralHero data. Minor mismatch: the registry metadata lists no required binaries or env vars, while the instructions do require the Membrane CLI and a Membrane account (network access). This is a documentation/metadata inconsistency but not a functional red flag.
Instruction Scope
The instructions are narrowly scoped to installing and using the Membrane CLI, creating a connection, running actions, and proxying requests to ReferralHero via Membrane. They do not instruct reading arbitrary local files or other unrelated system data. The skill explicitly advises against asking users for API keys and delegates auth to Membrane.
Install Mechanism
There is no built-in install spec in the registry (instruction-only), but the SKILL.md asks the user to install @membranehq/cli via npm (a public registry package). This is an expected, moderate-risk instruction for a CLI-based integration; no downloads from untrusted URLs or archive extraction are present in the instructions.
Credentials
The skill does not request environment variables or credentials itself. It requires a Membrane account and network access, which is proportionate for a proxy-based integration. The instructions claim that Membrane handles credentials server-side, so no local secret environment variables are needed.
Persistence & Privilege
The skill is not forced-always, has normal user-invocable/autonomous settings, and is instruction-only (no code written to disk by the skill). It does not request persistent system privileges or modifications to other skills' configs.
Assessment
This skill appears to do what it says: it uses the Membrane CLI to connect to ReferralHero and run actions or proxy requests. Before installing/using it, verify the Membrane CLI package and project (npm package @membranehq/cli and the repository/homepage) so you trust the software you will install. Be aware that creating a connection grants Membrane (and any agent using it) the ability to read/write ReferralHero data for that connection — only connect accounts you intend to expose. Installing a global npm CLI has the usual supply-chain risks; if you prefer, install the CLI in a controlled environment or inspect the package/source first. Note the metadata omission: the registry listing didn’t declare the CLI requirement or network/Membrane account dependency — this is likely a documentation gap, not malicious, but you may want to confirm with the skill/source before wide deployment.Like a lobster shell, security has layers — review code before you run it.
latestvk97etcdvycbsypg3x6wtk9a9c5843wkr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.