Zenhub
v1.0.2ZenHub integration. Manage data, records, and automate workflows. Use when the user wants to interact with ZenHub data.
⭐ 0· 78·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill is described as a ZenHub integration and all runtime instructions are about using the Membrane CLI to connect to ZenHub, discover actions, run them, or proxy requests. Required network access and a Membrane account are expected for this purpose.
Instruction Scope
SKILL.md confines activity to installing/using the Membrane CLI, creating a connector, listing/running actions, and proxying API requests. It does not instruct reading local unrelated files, accessing unrelated environment variables, or exfiltrating data to third-party endpoints beyond Membrane/ZenHub.
Install Mechanism
The skill is instruction-only (no install spec), but it asks the user to install an npm global package (@membranehq/cli). Installing global npm packages writes to disk and runs code from the npm registry — this is expected for a CLI but you should verify the package identity and trustworthiness. SKILL.md also suggests using npx in places (inconsistency but minor).
Credentials
No environment variables or credentials are declared or required by the skill; authentication is handled via Membrane's browser-based flow. Requested access is proportional to the described task (connecting to ZenHub via Membrane).
Persistence & Privilege
always:false (not force-included); disable-model-invocation:false (normal default). The skill does not request elevated host privileges or modify other skills. Note: if you allow autonomous invocation, an agent with this skill and an authorized Membrane connection could make API calls on your behalf — this is expected but worth considering.
Assessment
This skill looks coherent: it uses the Membrane CLI to connect to ZenHub and doesn't ask for unrelated credentials. Before installing, verify the @membranehq/cli package and the Membrane service (confirm the publisher and GitHub/npm pages), prefer using npx or inspecting the package before doing a global npm install, and be aware that if you allow the agent to invoke skills autonomously it could call your Membrane/ZenHub connections without further prompts. If you are uncomfortable with that, disable autonomous invocation for this skill or only invoke it manually.Like a lobster shell, security has layers — review code before you run it.
latestvk97d345wbszd8che8k3y43n3vn8428ad
License
MIT-0
Free to use, modify, and redistribute. No attribution required.