Vwork
v1.0.2VWork integration. Manage data, records, and automate workflows. Use when the user wants to interact with VWork data.
⭐ 0· 70·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill is described as a VWork integration and the SKILL.md uses the Membrane CLI to talk to VWork — this is consistent. Minor mismatch: the registry metadata lists no required binaries, but the instructions require npm/node (to install @membranehq/cli) and network access/a Membrane account (not declared in the top-level metadata).
Instruction Scope
All runtime instructions focus on using the Membrane CLI to discover connections, run actions, or proxy requests to the VWork API. The instructions do not request unrelated files, system credentials, or data exfiltration steps.
Install Mechanism
This is an instruction-only skill (no install spec). The instructions tell users to install a global npm package and use npx. Installing/running packages from the public npm registry is a normal pattern but executes third-party code on the host — moderate risk that should be evaluated by verifying the package provenance.
Credentials
The skill does not request any environment variables or secrets. It relies on Membrane-managed authentication (the documentation explicitly says not to ask users for API keys), which is proportionate to the stated purpose.
Persistence & Privilege
The skill is not marked always:true and does not request persistent system-wide changes in its instructions. It instructs the user to install a CLI (normal), but it does not attempt to modify other skills or system agent settings.
Assessment
Before installing or running this skill: (1) verify you trust the Membrane project and the @membranehq/cli npm package (check the official repo and publisher), because installing global npm packages runs code on your machine; (2) be aware the SKILL.md expects npm/node, network access, and a Membrane account (the registry metadata did not declare npm/node), so confirm your environment allows installing global npm packages; (3) using npx @membranehq/cli@latest will fetch the current package at runtime — prefer pinned versions if you need stability/auditability; (4) review Membrane's privacy and credential handling (the skill delegates auth to Membrane, so you should be comfortable with them holding connection tokens); (5) if you need stronger assurance, ask the publisher for an explicit install spec and to declare required binaries in the skill metadata.Like a lobster shell, security has layers — review code before you run it.
latestvk975wb02ab62nbtgfefky9kmds843b94
License
MIT-0
Free to use, modify, and redistribute. No attribution required.