Smartcar
v1.0.3Smartcar integration. Manage data, records, and automate workflows. Use when the user wants to interact with Smartcar data.
⭐ 0· 88·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Smartcar integration) align with the instructions (use Membrane CLI to connect to Smartcar, run actions, and proxy API requests). The requested capabilities (network access, Membrane account) are expected for this purpose.
Instruction Scope
SKILL.md stays within the stated purpose: it documents installing and using the Membrane CLI, creating connections, listing actions, running actions, and proxying requests to Smartcar. It does not instruct reading unrelated files or exfiltrating credentials; it explicitly advises against asking users for API keys.
Install Mechanism
The registry includes no install spec, but SKILL.md instructs installing @membranehq/cli via npm (global install) and using npx. Installing CLI tools from npm runs third-party code on the host — this is normal for a CLI integration but carries moderate supply-chain risk. Verify the package identity and source (e.g., official Membrane GitHub / npm entry) before installing.
Credentials
The skill declares no required env vars or secrets and delegates auth to Membrane (browser login flow). There are no requests for unrelated credentials or config paths, which matches the skill's purpose.
Persistence & Privilege
The skill itself is instruction-only and not forced (always:false). However, following the instructions will install a persistent CLI on the host and create local login state via Membrane. That persistence is expected for a CLI-based integration but is a user action to be aware of.
Assessment
This skill is coherent: it uses Membrane as a proxy/auth layer to talk to Smartcar and does not ask for unrelated secrets. Before installing anything, verify @membranehq/cli is the official package (check the project homepage/getmembrane.com and the GitHub repository), and be aware that 'npm install -g' will install third-party code and may require elevated rights. Installing the CLI will persist locally and perform browser-based login that stores credentials locally or server-side via Membrane. If you cannot or do not want to install a global CLI, do not follow the install steps; instead confirm alternative integrations or hosted approaches with Membrane documentation.Like a lobster shell, security has layers — review code before you run it.
latestvk977vvx6y7tyc8w9xa8qembw3d843qbs
License
MIT-0
Free to use, modify, and redistribute. No attribution required.