Vapi
v1.0.0Vapi integration. Manage data, records, and automate workflows. Use when the user wants to interact with Vapi data.
⭐ 0· 100·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description say 'Vapi integration' and the SKILL.md consistently describes using the Membrane CLI to connect to Vapi, discover actions, run actions, and proxy API requests. No unrelated environment variables, binaries, or config paths are requested.
Instruction Scope
Instructions are limited to installing and using the Membrane CLI, performing login via browser flow, creating connections, listing/running actions, and proxying requests through Membrane. The skill does not instruct reading arbitrary local files or exporting unrelated environment variables. Note: the 'membrane request' proxy capability intentionally allows arbitrary requests to the upstream service (expected for an integration) and therefore grants whatever access the established connection allows.
Install Mechanism
There is no platform install spec (instruction-only). The doc tells users to run `npm install -g @membranehq/cli` (or use npx). Installing a global npm package runs code from the public registry — a common pattern but one that carries typical npm supply-chain risks; verify the package source if you will install it.
Credentials
No environment variables or secrets are requested by the skill. The documentation explicitly advises creating a connection via Membrane instead of asking for API keys, which is proportionate to the stated purpose.
Persistence & Privilege
always is false, no config paths or system-wide changes are requested, and the skill does not ask to modify other skills. The agent can invoke the skill autonomously by default (normal platform behavior) but that is not combined with any broad credential requests or always:true privileges.
Assessment
This skill appears coherent and is instruction-only, but before installing or running commands: (1) Verify the Membrane CLI package (@membranehq/cli) is the official vendor release you expect; (2) Understand that installing a global npm package executes code from the npm registry — install in a controlled environment if you are cautious; (3) Be aware that creating a connection grants Membrane (and thus the connector) access to your Vapi account data — review Membrane and Vapi privacy/security policies and permissions; (4) Avoid running arbitrary `membrane request` calls without checking which endpoints and payloads will be sent; (5) If you do not want autonomous model-driven actions, consider disabling autonomous invocation or restricting agent permissions in your environment.Like a lobster shell, security has layers — review code before you run it.
latestvk97974pcm6zgbytd1avyywfcws84g49d
License
MIT-0
Free to use, modify, and redistribute. No attribution required.