Soci
v1.0.2Soci integration. Manage data, records, and automate workflows. Use when the user wants to interact with Soci data.
⭐ 0· 97·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill claims to integrate with Soci via Membrane and the SKILL.md consistently describes using the Membrane CLI and a Membrane account. However, the registry metadata lists no required binaries or environment variables while the instructions explicitly require network access and installing/running the @membranehq/cli (npm) tool — a minor inconsistency between declared metadata and the runtime instructions.
Instruction Scope
Instructions are narrowly scoped to installing/using the Membrane CLI, authenticating the user, discovering connectors/actions, running actions, and proxying requests to the Soci API. The docs do not instruct reading unrelated local files or asking for unrelated secrets. Note: the 'membrane request' capability allows arbitrary proxied HTTP calls to Soci endpoints (which is expected for this type of integration but means the agent could transmit arbitrary data to the connected service).
Install Mechanism
This is an instruction-only skill (no install spec), and recommends installing the Membrane CLI via npm (npm install -g @membranehq/cli) or using npx. Installing a global npm package is a standard pattern but does write to disk and pulls code from the public npm registry — verify you trust the @membranehq/cli package and prefer npx if you want fewer global changes.
Credentials
The skill does not request any environment variables or credentials in metadata; runtime instructions rely on Membrane to manage authentication via the browser-based login flow (no local API keys requested). This is proportionate to the stated purpose. The SKILL.md does mention network access and a Membrane account, which are appropriate and expected but were not enumerated in the registry fields.
Persistence & Privilege
The skill is instruction-only, requests no persistent 'always' privilege, and does not modify other skills or system-wide configuration. It relies on the Membrane CLI and the user's Membrane account for any stored credentials (server-side).
Assessment
This skill appears to do what it says: integrate with Soci through Membrane. Before installing, verify the @membranehq/cli npm package and the Membrane vendor (homepage/repo) to ensure you trust the upstream publisher. Prefer running commands via npx if you want to avoid a global install. Be aware that 'membrane request' lets the agent send arbitrary proxied API calls to Soci — don't give the agent access to sensitive data you wouldn't want transmitted. Also note the small metadata mismatch: the registry did not declare the network/Membrane CLI requirement even though the SKILL.md does; treat the SKILL.md as authoritative and review the commands it instructs you to run. If you need higher assurance, review the Membrane CLI source/release, run it in an isolated environment, or ask the skill author for clarifying metadata before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk973384fxvq57g0f7znvf7wef9842qvb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.