Trinet

This skill is internally consistent for connecting to TriNet through Membrane, but be aware of these practical risks before installing: - Membrane acts as the intermediary: authentication and API calls are brokered through Membrane. That means TriNet HR/payroll data will transit and be accessible to the Membrane service according to their policies. Review Membrane's privacy/security docs and connector scopes before granting access. - The SKILL.md asks you to install a global npm package (@membranehq/cli). Global npm installs change your system environment and require permissions; install only from trusted sources. - Once you run membrane login and create a connection, that connection token grants access to TriNet data. Limit scope (least privilege) and prefer test accounts when possible. - The skill exposes a generic 'membrane request' proxy capability — it can issue arbitrary TriNet API requests via the connection. That capability is expected for a full integration but is powerful: only use when necessary and audit actions/logs. - If you don't trust Membrane or must keep HR data in-house, do not create the connection. If you are concerned about autonomous agent runs, restrict or disable the skill when not actively using it. Overall, the skill appears to do what it says (benign), but exercise normal caution because it enables access to sensitive HR data via a third party.