Surveysparrow
v1.0.2SurveySparrow integration. Manage Surveys, Contacts, Responses, Reports, Users, Workspaces. Use when the user wants to interact with SurveySparrow data.
⭐ 0· 74·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name and description align with the instructions: it operates on SurveySparrow via Membrane. However, SKILL.md requires the @membranehq/cli (installed via npm or npx) while the registry metadata declares no required binaries. This is a mismatch between declared requirements and runtime instructions.
Instruction Scope
The instructions confine the agent to using the Membrane CLI to discover connectors, create connections, run actions, and optionally proxy raw SurveySparrow API requests. They do not direct reading unrelated files, harvesting unrelated environment variables, or exfiltrating data to third-party endpoints beyond Membrane/SurveySparrow.
Install Mechanism
There is no formal install spec in the registry (skill is instruction-only), but SKILL.md instructs users to run `npm install -g @membranehq/cli` and to use `npx`. Installing a global npm package runs code from the npm registry; this is common but carries the usual supply-chain considerations. The absence of a declared install requirement in registry metadata is a documentation/integration gap.
Credentials
The skill requests no environment variables or secrets. It explicitly recommends letting Membrane handle credentials server-side rather than asking users for API keys, which is proportionate to the stated purpose.
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. It does require the user to perform an interactive `membrane login`, which will create credentials managed by Membrane outside the skill; this is expected for a connector-driven integration.
Assessment
This skill looks coherent for integrating SurveySparrow via Membrane, but note SKILL.md requires installing the @membranehq/cli even though the registry metadata didn't list that binary. Before installing or running the CLI: 1) Verify you trust Membrane and the npm package (@membranehq/cli) by reviewing its npm page and source repository; 2) prefer using npx for one-off use to avoid a global install if you don't want a persistent binary; 3) be aware `membrane login` opens a browser and will create and store credentials with Membrane (server-side); 4) don't share unrelated API keys or secrets with the skill—Membrane is intended to manage auth for you. If any of these steps are unacceptable or you don't trust Membrane/getmembrane.com, avoid installing or running the CLI.Like a lobster shell, security has layers — review code before you run it.
latestvk9769x3pr82trwmj6k5hahtx2s84335q
License
MIT-0
Free to use, modify, and redistribute. No attribution required.