Talkspirit
v1.0.0TalkSpirit integration. Manage data, records, and automate workflows. Use when the user wants to interact with TalkSpirit data.
⭐ 0· 31·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (TalkSpirit integration) matches the instructions: the SKILL.md tells the agent to use the Membrane CLI to connect to TalkSpirit, discover actions, run actions, and proxy raw requests. No unrelated services, credentials, or binaries are requested by the skill itself.
Instruction Scope
Instructions are focused on installing and using the Membrane CLI, logging in (browser-based OAuth flow), creating a connector, listing connections/actions, running actions, and proxying requests. The doc explicitly advises against asking users for API keys. It does instruct the operator to run commands that may open a browser and perform auth; this is expected for the stated purpose but does require user interaction and network access.
Install Mechanism
There is no automatic install spec in the skill bundle (instruction-only). The SKILL.md recommends installing @membranehq/cli via 'npm install -g' and using npx for some commands. This is consistent with the workflow but does carry the usual supply-chain considerations of installing packages from the npm registry (global installs modify local system state and npx can fetch remote code).
Credentials
The skill requests no environment variables, credentials, or config paths. It requires a Membrane account (handled by the CLI) and a TalkSpirit connection created through Membrane — this is proportional to a connector-style integration.
Persistence & Privilege
The skill is not set to always:true and does not request elevated platform privileges. It is user-invocable and (like most skills) can be invoked autonomously by the agent; nothing in the skill attempts to modify other skills or system-wide agent settings.
Scan Findings in Context
[no-findings] expected: The static regex scanner found no code to analyze because this is an instruction-only skill (only SKILL.md). That is expected; absence of findings is not evidence of safety but is consistent with the bundle content.
Assessment
This skill appears coherent: it just documents using the Membrane CLI to access TalkSpirit. Before installing or following its instructions, consider: 1) Installing CLI tools (npm -g) modifies your system and pulls code from the npm registry — prefer 'npx' or install locally if you are concerned. 2) Verify the @membranehq/cli package and the Membrane service (review their homepage, GitHub repo, and privacy/auth policies) before granting access. 3) The CLI uses a browser OAuth flow to obtain access; only grant the connector the minimal TalkSpirit permissions needed. 4) Because the skill relies on an external CLI and networked auth, run commands manually rather than allowing any automated agent to perform them if you want tighter control. 5) If you need higher assurance, inspect the Membrane CLI source before installing and avoid global installs on production machines.Like a lobster shell, security has layers — review code before you run it.
latestvk976csqv8qp1av6xwchc1t90r9848rj8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.