Streamtime

• Verdict: Pass
• Confidence: Medium
• Analyzed: Apr 2, 2026, 10:44 PM
• Findings: 0
• Version: 1.0.2

Overview

The skill's instructions and requirements are consistent with a Streamtime integration that uses the Membrane CLI as a proxy, but it relies on executing a remote npm CLI and storing credentials locally, which has supply‑chain and privacy implications the user should consider.

This skill appears to do what it says: it uses the Membrane CLI to talk to Streamtime. Before installing or using it, consider: (1) npx @membranehq/cli@latest will download and run remote code from npm each time — if you need stronger guarantees, prefer a pinned version and inspect the package source. (2) Authentication is performed via Membrane and credentials are stored locally at ~/.membrane/credentials.json and are used to make proxied requests through Membrane's servers — verify you trust Membrane's service and privacy policy for any sensitive data. (3) If you care about limiting agent autonomy, note this skill can be invoked by the agent by default; restrict autonomous use in agent settings if needed. If you want a deeper review, provide the npm package repository or Membrane service documentation so I can check the package maintainer, repository, and release provenance.