Workamajig
v1.0.2Workamajig integration. Manage data, records, and automate workflows. Use when the user wants to interact with Workamajig data.
⭐ 0· 122·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (Workamajig integration) align with the instructions: the SKILL.md shows how to authenticate via Membrane, create a Workamajig connection, list and run actions, and proxy API requests. Nothing requested in the doc appears unrelated to interacting with Workamajig.
Instruction Scope
Instructions are narrowly scoped to installing/using the Membrane CLI, authenticating, discovering actions, running actions, and proxying to the Workamajig API. The document does not instruct reading unrelated files or environment variables. The proxy capability can send arbitrary Workamajig requests (expected for this integration) — users should be aware that any data sent via the proxy goes through Membrane.
Install Mechanism
There is no platform install spec in the registry (instruction-only). The SKILL.md recommends installing @membranehq/cli via npm -g (a third-party npm package). That is a standard approach but does introduce supply-chain risk: vet the package (npm page, repository, publisher) before installing globally or prefer npx to avoid a global install.
Credentials
The skill declares no required environment variables or host config paths. It relies on a Membrane account for authentication; asking for that account access is proportional to the stated purpose. No unrelated credentials or system paths are requested in the instructions.
Persistence & Privilege
The skill does not request always:true or other elevated persistent privileges. It is user-invocable and supports autonomous invocation (the platform default) — that is expected for skills. It does not instruct changing other skills or global agent settings.
Assessment
This skill appears to be what it claims: a wrapper telling the agent to use the Membrane CLI to talk to Workamajig. Before using it, do the following: (1) Inspect the @membranehq/cli package on npm and its GitHub repo to confirm the publisher and review permissions; (2) Prefer npx or a local install instead of npm -g if you're cautious about global packages; (3) Review what scopes/permissions the Membrane login grants and limit them where possible; (4) Understand that Membrane will proxy API requests (so sensitive data sent through these actions will transit Membrane); (5) If you do not trust Membrane or the CLI, do not provide credentials and avoid installing the package. If you want a deeper assessment, provide the full un-truncated SKILL.md or links to the referenced Membrane CLI repository and npm package so I can check exact commands and any additional instructions.Like a lobster shell, security has layers — review code before you run it.
latestvk97cah1wp0c879ct3n636yy171842p25
License
MIT-0
Free to use, modify, and redistribute. No attribution required.