Zoho Invoice
v1.0.2Zoho Invoice integration. Manage data, records, and automate workflows. Use when the user wants to interact with Zoho Invoice data.
⭐ 0· 70·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the instructions: the SKILL.md explains how to use the Membrane CLI to connect to Zoho Invoice, discover actions, run them, and proxy raw API requests. The required network access and a Membrane account are reasonable and expected for this purpose.
Instruction Scope
Instructions are narrowly scoped to installing/using the Membrane CLI, performing browser-based login, creating a connection to Zoho Invoice, listing/running actions, and proxying API requests. The skill does not instruct reading local files, harvesting unrelated env vars, or sending data to unexpected endpoints; proxying arbitrary paths is allowed but is coherent with a connector-style integration.
Install Mechanism
This is an instruction-only skill (no install spec), but it tells users to install @membranehq/cli via npm -g. Installing a global npm package is common for CLIs but increases attack surface compared with a pure-instruction skill — the package comes from the public npm registry, so users should verify the package and its publisher before installing.
Credentials
The skill declares no required env vars, no primary credential, and no config paths. The SKILL.md explicitly tells agents not to ask for API keys and to let Membrane manage auth, which aligns with the declared absence of local secrets.
Persistence & Privilege
The skill does not request always:true or other elevated persistence. It is user-invocable and allows normal autonomous invocation; nothing in the instructions modifies other skills or system-wide config.
Assessment
This skill appears to do what it says: it relies on Membrane to handle authentication and proxies to Zoho Invoice. Before installing or following the instructions: (1) confirm you trust Membrane as a third-party service and review their privacy/security docs because connectors and credentials are stored/managed server-side; (2) verify the npm package @membranehq/cli (publisher, version, and source) before running npm -g; (3) when creating connections, limit the connector scopes to the minimum needed and only connect accounts you control; (4) if you run in a headless or shared environment, keep the login URL/code private; and (5) check the referenced GitHub repository/homepage for legitimacy if you need higher assurance.Like a lobster shell, security has layers — review code before you run it.
latestvk97b3t0vyh17ekvfr3c05d0mqn843dwt
License
MIT-0
Free to use, modify, and redistribute. No attribution required.