Slottable
v1.0.2Slottable integration. Manage Users, Organizations, Files, Notes, Activities. Use when the user wants to interact with Slottable data.
⭐ 0· 129·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description say "Slottable integration" and the SKILL.md tells the agent how to install and use the Membrane CLI to connect, list, and run Slottable actions or proxy API requests. Required capabilities (network, Membrane CLI) are coherent with the stated purpose and no unrelated credentials or system access are requested.
Instruction Scope
Runtime instructions are limited to installing/using the @membranehq/cli, authenticating via browser (or headless code flow), creating/using connections, listing actions, running actions, and proxying API requests. The doc does not instruct reading arbitrary files, harvesting unrelated env vars, or sending data to unexpected endpoints outside Membrane/Slottable.
Install Mechanism
There is no registry install spec, but the SKILL.md tells users to run `npm install -g @membranehq/cli`. Installing a global npm package is a reasonable step for this tool but carries the usual supply-chain risk (npm package provenance, maintainer trust). This is moderate-risk but expected for a CLI-based integration; verify the package and repository before installing globally.
Credentials
The skill requests no environment variables or local secrets. It explicitly delegates credential management to Membrane (server-side). That is proportionate to integrating with a third-party API — however, this means credentials will be managed/stored by Membrane's service, so you should assess whether you trust that provider.
Persistence & Privilege
always:false and no install-time disk artifacts are declared by the registry, so the skill does not request persistent, global presence. Note: the platform default allows autonomous invocation of the skill; that means an agent could run CLI commands or proxy API calls if allowed. This is expected behavior but worth considering if you plan to permit autonomous agents network access.
Assessment
This skill appears coherent: it simply instructs use of the Membrane CLI to manage Slottable data. Before installing/using it, verify you trust the Membrane project and its npm package (@membranehq/cli) — check the GitHub repo, package publisher, and recent releases. Installing a global npm CLI modifies your environment; prefer a scoped/local install or containerized environment if you have supply-chain concerns. Understand that authentication is handled server-side by Membrane (they will hold connections/refresh tokens), so review their privacy/security policies. If you are worried about an agent making network calls autonomously, restrict agent permissions or require explicit invocation rather than enabling autonomous runs.Like a lobster shell, security has layers — review code before you run it.
latestvk97dsx4vrxra8syxvey7szx0ax84237z
License
MIT-0
Free to use, modify, and redistribute. No attribution required.