Turbot Pipes
v1.0.0Turbot Pipes integration. Manage data, records, and automate workflows. Use when the user wants to interact with Turbot Pipes data.
⭐ 0· 29·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the SKILL.md: the skill is an integration that uses the Membrane CLI to interact with Turbot Pipes. It does not request unrelated credentials, binaries, or config paths.
Instruction Scope
Instructions are limited to installing/using the Membrane CLI, logging in (browser-based), creating connections, listing actions, running actions, and proxying requests. They do not instruct reading local secret files or unrelated system paths. Note: proxying and action execution send requests via Membrane, so data and target API credentials will transit through/ be managed by the Membrane service.
Install Mechanism
No registry install spec is present (instruction-only). The SKILL.md recommends installing @membranehq/cli via npm -g (or using npx in examples). Installing a global npm CLI is a common approach but should be considered a moderate-risk action (third-party code installed on the system).
Credentials
The skill declares no required env vars or credentials and explicitly advises not to ask the user for API keys. However, it requires a Membrane account and browser login; Membrane will hold/manage credentials and perform proxying on the user's behalf — this is proportional to the integration but does mean sensitive tokens live with the Membrane service rather than only locally.
Persistence & Privilege
The skill does not request always:true, has no install-time hooks, and is instruction-only. It does rely on the agent having network access and on the user performing a Membrane login, but it does not modify other skills or system-wide agent settings.
Assessment
This skill is internally consistent: it uses the Membrane CLI to connect to Turbot Pipes and does not ask for unrelated secrets. Before installing or using it, consider: (1) installing via npx when possible instead of a global npm -g to reduce system changes; (2) understand that Membrane (a third party) will manage your Turbot Pipes credentials and will proxy API requests — review Membrane's privacy/security policies and the permissions granted when you create the connection; (3) when the agent runs actions or proxy requests, verify the action IDs and connection IDs it intends to use to avoid unintended changes; and (4) confirm the @membranehq/cli package and its GitHub repo are the official sources you expect.Like a lobster shell, security has layers — review code before you run it.
latestvk974t0hrgkjtgdfzwgtfab0091847j4j
License
MIT-0
Free to use, modify, and redistribute. No attribution required.