Thoughtful Gpt
v1.0.2Thoughtful GPT integration. Manage data, records, and automate workflows. Use when the user wants to interact with Thoughtful GPT data.
⭐ 0· 87·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description (integrating with Thoughtful GPT, managing records and workflows) aligns with the instructions: all operations are performed via the Membrane CLI and a Membrane connector. Requiring network access and a Membrane account is appropriate for this purpose.
Instruction Scope
SKILL.md confines actions to installing/using the Membrane CLI, performing browser-based login, listing/creating connections, running actions, or proxying API requests through Membrane. These are within scope, but proxying means user data and requests will traverse Membrane's service—users should be aware data will be sent to that third party.
Install Mechanism
There is no formal install spec in the registry, but the doc instructs installing @membranehq/cli via npm -g. This is a common but non-trivial action (global npm install writes to disk and pulls code from the npm registry). It's moderate risk and should be verified (package provenance, npm page, GitHub repo) before installing.
Credentials
The skill declares no required env vars, no config paths, and the instructions explicitly advise not to ask users for API keys (using browser-based login instead). The requested access is proportional to the stated functionality.
Persistence & Privilege
The skill does not request always:true, does not install or modify persistent agent configs via an install spec, and does not request elevated or cross-skill privileges. Autonomous invocation is allowed (platform default) but not combined with other concerning privileges.
Assessment
This skill is instruction-only and expects you to install and use the Membrane CLI and to authenticate via a browser-based flow. Before installing or using it: 1) verify the npm package (@membranehq/cli) and its GitHub repo match the vendor (check npmjs.com and the GitHub repo), 2) understand that requests and data will be proxied through Membrane—check their privacy/security policy if you plan to send sensitive data, 3) prefer installing the CLI in a controlled environment (avoid global installs on critical machines) and inspect what the CLI does, and 4) confirm the 'Thoughtful GPT' service and connector exist and that the connector's requested permissions are acceptable. The skill itself is coherent with its stated purpose, but exercise normal caution when installing third-party CLIs and when sending data through a proxy service.Like a lobster shell, security has layers — review code before you run it.
latestvk9777w0jkqx6v4h9bp2ksb09kn8427fe
License
MIT-0
Free to use, modify, and redistribute. No attribution required.