Talentlyft
v1.0.0TalentLyft integration. Manage data, records, and automate workflows. Use when the user wants to interact with TalentLyft data.
⭐ 0· 25·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description claim a TalentLyft integration and the SKILL.md consistently instructs use of the Membrane CLI to discover and run TalentLyft actions or proxy raw API calls. The requested operations (connect, list actions, run actions, proxy requests) match the stated purpose.
Instruction Scope
Instructions are scoped to installing/using the Membrane CLI, creating a connector, listing/running actions, and proxying TalentLyft API requests. The instructions do not instruct reading unrelated local files or harvesting environment variables. They do allow making arbitrary proxied API calls to TalentLyft (expected for a connector) which can modify data if actions used are write-capable.
Install Mechanism
This is an instruction-only skill (no install spec), but it tells users/agents to run `npm install -g @membranehq/cli`. Global npm install is a common way to install CLIs but does execute third-party code from npm; this is expected for using Membrane but is a non-trivial installation step and relies on trusting the @membranehq/cli package and npm registry.
Credentials
The skill declares no required environment variables or credentials and explicitly delegates authentication to Membrane. That is proportionate: a connector-based integration usually doesn't ask the skill for API keys. The skill does implicitly require a Membrane account and network access (stated).
Persistence & Privilege
The skill is not always-enabled and does not request persistent system config or other skills' credentials. Model invocation is allowed (platform default); combined with the ability to run actions this means the agent could autonomously call TalentLyft endpoints — expected for an integration but worth awareness.
Assessment
This skill is internally consistent: it tells the agent to install and use the Membrane CLI to connect to TalentLyft and does not request unrelated secrets. Before installing, consider: (1) you will need to trust the @membranehq/cli npm package and Membrane's service – review their homepage/repo and verify package provenance; (2) installing with `npm -g` runs third‑party code globally—do this only on hosts you control; (3) the connector can run write-capable API calls via the proxy, so only connect accounts with appropriate (least-privilege) scopes or use a limited service account; (4) the skill is instruction-only and wasn't code-scanned, so review Membrane's security/privacy docs and the connector permissions before giving access. If you want higher assurance, ask the publisher for the exact connector scopes, the Membrane CLI package hash/version to install, or a link to the connector's documentation/source.Like a lobster shell, security has layers — review code before you run it.
latestvk9701rtg5tcsa410fv36vfs6f9844jf3
License
MIT-0
Free to use, modify, and redistribute. No attribution required.