Wonderchat
v1.0.2Wonderchat integration. Manage data, records, and automate workflows. Use when the user wants to interact with Wonderchat data.
⭐ 0· 83·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill claims to integrate with Wonderchat and the SKILL.md only asks the agent to use the Membrane CLI to discover connectors, create connections, run actions, or proxy API requests. The requested actions map to the stated purpose.
Instruction Scope
Instructions direct the agent to run membrane CLI commands, perform login flows (browser or headless), create connections, run actions, and proxy arbitrary API requests through Membrane. The proxy capability means user data and API requests will be sent to Membrane's service — this is coherent for a managed integration but has privacy/telemetry implications that users should be aware of. The instructions do not ask the agent to read unrelated local files or environment variables.
Install Mechanism
There is no platform install spec; the SKILL.md instructs a user to run `npm install -g @membranehq/cli` and uses `npx @membranehq/cli@latest` in examples. Installing a global npm package and invoking latest via npx is a common but moderate-risk mechanism (packages come from the public registry and versions are not pinned). The skill does not include integrity checks or a pinned release.
Credentials
The skill declares no required env vars or credentials and relies on Membrane to handle auth server-side. That is proportionate to its purpose. Note: using Membrane means credentials and proxied requests are handled by their service rather than local secrets.
Persistence & Privilege
The skill is instruction-only, has no install performed by the platform, and does not request always:true or other elevated persistence. Agent autonomous invocation is allowed by default but not combined with other privilege concerns here.
Assessment
This skill appears to do what it says, but before installing or following its instructions: (1) Verify the @membranehq/cli npm package and its maintainer (check the npm listing, GitHub repo, and company at getmembrane.com). (2) Understand that requests and credentials are proxied via Membrane — any data you send (messages, user records) will transit their service. If that matters for privacy/compliance, avoid or review the flow. (3) Prefer running the CLI in an isolated environment or pinning a specific CLI version instead of `@latest`. (4) Do not paste unrelated secrets into commands; follow the browser-based login flows. If you need more assurance, provide the CLI project repo or vendor security docs and I can re-evaluate with higher confidence.Like a lobster shell, security has layers — review code before you run it.
latestvk9736vjcxdt7y8bskscfb1vtbn8429y4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.