Z Api

v1.0.2

Z-API integration. Manage data, records, and automate workflows. Use when the user wants to interact with Z-API data.

0· 116·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name and description claim a Z-API integration and the SKILL.md exclusively documents using the Membrane CLI to connect to Z-API, discover actions, run them, and proxy raw requests. Required items (none) are consistent with an instruction-only skill that relies on a third-party CLI and network access.
Instruction Scope
Instructions tell the user/agent to install and run the @membranehq/cli, perform login flows, create connections, run actions, and proxy requests through Membrane. This stays on-topic for an integration skill, but it does imply sending API requests and any request payloads through Membrane's servers (the document explicitly says Membrane injects auth headers and proxies requests). That is expected for this design but is a privacy/data-exposure consideration.
Install Mechanism
No automated install spec is included in the package (instruction-only). The SKILL.md recommends npm install -g @membranehq/cli. Using an externally-published npm CLI is a reasonable approach for this use case, but global npm installs run third-party code and are a moderate-risk operation — users should trust the package and/or inspect its source before running.
Credentials
The skill requests no environment variables or local config paths. Authentication is delegated to Membrane's login flow; no local secrets are requested by the skill. This is proportionate to the stated goal (using Membrane as the auth/connector provider).
Persistence & Privilege
The skill is not always-enabled and does not request elevated / persistent platform privileges. It is user-invocable and can be called autonomously by the agent (platform default), which is expected for skills and acceptable here.
Assessment
This skill is coherent: it expects you to install and use the Membrane CLI to proxy requests to Z-API. Before installing or using it, consider these points: - Trust and data exposure: Membrane will handle authentication and forward requests, so Membrane's service will see any request payloads and responses. Only use this if you trust the Membrane provider and are comfortable with that data flow. - npm global install: The SKILL.md asks you to run `npm install -g @membranehq/cli` which executes third-party code on your system. If you have security concerns, review the CLI repository or run it in a constrained environment (container or VM) rather than your primary workstation. - Least privilege: Use an account or connection with the minimum privileges needed for the tasks, and avoid sending highly sensitive secrets or PII unless you are certain about retention/processing policies. - Audit the CLI: If you need higher assurance, inspect the @membranehq/cli source at the referenced repository (or the published package) to confirm it behaves as documented, especially around credential handling and telemetry. If you are comfortable with those trade-offs, this skill appears to be what it claims to be.

Like a lobster shell, security has layers — review code before you run it.

latestvk97a85m220j1arf7p9w7jzc415843ws3

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments