Tripetto
v1.0.0Tripetto integration. Manage data, records, and automate workflows. Use when the user wants to interact with Tripetto data.
⭐ 0· 28·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name and description (Tripetto integration) align with the runtime instructions: the SKILL.md shows how to discover connectors, create connections, run actions, and proxy API requests to Tripetto via the Membrane CLI. Nothing requested is unrelated to managing Tripetto data.
Instruction Scope
The instructions ask the agent/operator to install and use the @membranehq/cli, to run interactive login flows, to create connections, list actions, run actions, and to proxy arbitrary Tripetto API calls through Membrane. This is in-scope for a Tripetto integration, but it does mean arbitrary request payloads and responses will flow through the Membrane service (the doc explicitly describes proxy usage).
Install Mechanism
There is no registry install spec, but SKILL.md instructs installing the Membrane CLI via npm (global install) or using npx. Installing a third‑party npm CLI globally executes remote package code and alters the host environment; this is expected for a CLI-based integration but carries the normal supply-chain/privilege considerations of npm global installs.
Credentials
The skill declares no required environment variables or credentials and relies on Membrane to handle auth. That is proportionate: users create a connection through Membrane rather than supplying API keys to the skill. The tradeoff is trusting Membrane to store/handle Tripetto credentials.
Persistence & Privilege
The skill does not request always:true or other elevated persistence, and it is instruction-only with no code written to disk by the registry. The agent can invoke it normally (default) which is appropriate for this integration.
Assessment
This skill is coherent and appears to do what it says: it teaches the agent/operator to use the Membrane CLI to access Tripetto. Before installing or using it, consider: (1) Membrane acts as a proxy and will see request/response data and hold Tripetto credentials—review Membrane's privacy/security practices and trustworthiness; (2) prefer running via npx or inspecting the CLI package before doing a global npm install to reduce supply-chain risk; (3) the SKILL.md allows sending arbitrary API requests through the proxy—be cautious about sending sensitive data; (4) if you require an auditable/isolated setup, run the CLI and commands in a controlled environment and review connection scopes/permissions. If you want greater assurance, ask the publisher for the skill's source repository or a signed vendor attestation that this is an official Membrane integration.Like a lobster shell, security has layers — review code before you run it.
latestvk971hb02amcm9am6eea8ph16r1847qva
License
MIT-0
Free to use, modify, and redistribute. No attribution required.