Shopwaive
v1.0.2Shopwaive integration. Manage Organizations. Use when the user wants to interact with Shopwaive data.
⭐ 0· 109·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (Shopwaive integration) match the SKILL.md instructions, which consistently direct the agent to use the Membrane CLI to discover connectors, create a connection, run actions, or proxy API requests to Shopwaive. Nothing requested in the skill (no env vars, no config paths) is out of proportion with the stated purpose. Note: the registry 'Source' is listed as unknown in the metadata while the documentation points to Membrane/getmembrane; users may want to confirm the publisher before installing.
Instruction Scope
All runtime instructions are limited to installing/using the Membrane CLI, logging in via Membrane, discovering connectors/actions, running actions, and proxying requests to the Shopwaive API. The instructions do not ask the agent to read arbitrary files, scan the system, or exfiltrate unrelated data. Minor scope note: the skill instructs a global npm install (executes third-party code on the machine) and also suggests npx in places — consider using npx or confirming the package source to avoid unnecessary global installs.
Install Mechanism
This is an instruction-only skill with no install spec. It tells users to install @membranehq/cli via 'npm install -g' (and uses npx in examples). Installing an npm package runs code from the npm registry on the host — a normal risk for CLI-based integrations but not disproportionate. There are no downloads from obscure URLs or archive extraction steps in the skill itself.
Credentials
The skill declares no required environment variables or credentials. The SKILL.md explicitly recommends letting Membrane manage credentials (do not ask the user for API keys), which aligns with its design. No unrelated secrets or config paths are requested.
Persistence & Privilege
always is false and the skill has no install-time code; it does not request persistent system privileges or modify other skills or system-wide agent settings. Autonomous invocation (disable-model-invocation: false) is the platform default and not sufficient alone to raise concern here.
Assessment
This skill appears to do what it says: it instructs the agent to use the Membrane CLI to manage Shopwaive connectors and proxy API calls. Before installing or following the instructions: verify the publisher (homepage and repo) to ensure you're using the official Membrane CLI; prefer using 'npx @membranehq/cli@latest' for one-off use instead of a global 'npm install -g' to avoid persisting third-party code system-wide; expect it to require a Membrane account and network access; do not provide raw API keys to the agent — use the connection flow described. If you have strict supply-chain or endpoint-trust requirements, review the Membrane project's repo and package maintainers first.Like a lobster shell, security has layers — review code before you run it.
latestvk97dwfcf8hg4jn0qa6rbpc9c0n8436e4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.