Reviewstudio
v1.0.0Review Studio integration. Manage data, records, and automate workflows. Use when the user wants to interact with Review Studio data.
⭐ 0· 31·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description (Review Studio integration) match the runtime instructions (use Membrane to connect, run actions, or proxy requests to Review Studio). However, the skill instructs installing the Membrane CLI (npm install -g @membranehq/cli) yet the metadata lists no required binaries — a minor inconsistency: the skill effectively requires Node/npm (or the membrane binary) to be present.
Instruction Scope
SKILL.md only instructs the agent/operator to install and use the Membrane CLI (login, connect, action list/run, and membrane request proxy). It does not ask the agent to read unrelated local files, environment variables, or to exfiltrate data to unexpected endpoints. All external requests are routed through Membrane, which is consistent with the stated purpose.
Install Mechanism
There is no formal install spec in the registry (instruction-only), but the doc recommends a global npm install of @membranehq/cli (public npm package). Installing a global npm CLI runs third-party code on the host (moderate risk). This is a common pattern for CLIs but should be noted; the skill metadata should have declared the dependency on the membrane binary/Node tooling.
Credentials
The skill declares no required environment variables or credentials and explicitly recommends creating a connection so Membrane handles auth server-side. That is proportionate to the stated purpose. The main consideration is trust: using the skill means delegating Review Studio credentials/auth to Membrane (they will proxy requests and manage token refresh).
Persistence & Privilege
The skill is instruction-only, has always:false, and does not request persistent system privileges or modify other skills' config. It does not request to be force-included or persistently injected into agent runs.
Assessment
This skill is an instruction-only connector that relies on the Membrane CLI to access Review Studio. Before installing or using it: 1) Be aware you will need Node/npm or the membrane binary even though the registry metadata didn't list required binaries — consider using npx to avoid a global install (the SKILL itself even uses npx in examples). 2) Installing a global npm package runs third-party code on your machine; review @membranehq/cli’s package and releases if you have strict policies. 3) Using the skill delegates Review Studio credentials and API traffic to Membrane (they store/manage tokens and proxy requests) — verify Membrane’s security, privacy, and compliance posture before connecting sensitive accounts. 4) If you must avoid sending data to a third-party service, don’t use the connector; instead use direct API access under your control. Overall the skill appears coherent for its purpose, but exercise normal caution around installing CLIs and delegating credentials to an external service.Like a lobster shell, security has layers — review code before you run it.
latestvk97fx5ked528ak98x1x7w19hph845vdv
License
MIT-0
Free to use, modify, and redistribute. No attribution required.