Wrike
v1.0.2Wrike integration. Manage Users, Organizations, Projects, Tasks, Folders, Spaces and more. Use when the user wants to interact with Wrike data.
⭐ 0· 47·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description match the instructions: the skill is a Wrike integration and all runtime steps call the Membrane CLI to interact with Wrike. Requesting network access and a Membrane account is coherent for this purpose.
Instruction Scope
SKILL.md stays on-topic: it instructs the agent to install and use the Membrane CLI, create a connection, list actions, run actions, or proxy requests. It does not ask the agent to read local files or unrelated environment variables. However, proxying requests via Membrane means requests and data will flow through Membrane's servers — the SKILL.md does not explicitly call out what data is visible to that third party.
Install Mechanism
There is no formal install spec in the registry, but the instructions tell the user to run `npm install -g @membranehq/cli`. Installing a global npm package is a common but non-trivial action: it downloads and executes code from the npm registry (moderate risk). This is expected for a CLI-based integration but is a point where users should verify package provenance.
Credentials
The skill declares no required env vars or secrets (good). Instead it relies on Membrane-managed connections (browser-based login). That is proportionate for a connector, but it centralizes credentials and request traffic with Membrane — a trust/privacy consideration rather than a technical mismatch.
Persistence & Privilege
The skill does not request always:true, does not require system-level config, and is instruction-only (no files written by the skill itself). Normal autonomous invocation is allowed (platform default).
Scan Findings in Context
[no-findings] expected: The static regex scanner had no files to analyze (this is an instruction-only skill). That absence is expected but means there is no code-level scan signal to review.
Assessment
This skill appears coherent for a Wrike integration but relies on a third-party service (Membrane) and asks you to install their npm CLI. Before installing or using it: (1) Verify @membranehq/cli provenance (review the package and its GitHub repo and publisher), (2) Understand that API calls and data will be proxied through Membrane — if you have sensitive Wrike data, confirm Membrane's privacy/security practices and whether data is logged, (3) Prefer least-privilege connections in Wrike (create limited-scope accounts if possible), (4) Avoid pasting raw secrets into chat — use the Membrane connection flow as instructed, and (5) If you prefer not to trust a third party, consider using Wrike's official API directly with your own isolated tooling.Like a lobster shell, security has layers — review code before you run it.
latestvk97e37sahpb75pcbf4q5vc8y418423w9
License
MIT-0
Free to use, modify, and redistribute. No attribution required.