1Msg
v1.0.21msg integration. Manage data, records, and automate workflows. Use when the user wants to interact with 1msg data.
⭐ 0· 94·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill's description and runtime instructions consistently describe a 1msg integration implemented via the Membrane CLI. However, the registry metadata lists no required binaries while SKILL.md explicitly requires the 'membrane' CLI (installed via npm). This is an inconsistency in metadata but not an indication the functionality is unrelated to the stated purpose.
Instruction Scope
SKILL.md confines actions to using Membrane to list/connect/run actions and proxy requests to the 1msg API. It does not ask the agent to read unrelated files or environment variables. The proxy feature allows arbitrary paths against the target API (useful but capable of broad API access), which is expected for this integration.
Install Mechanism
There is no formal install spec in the registry, but SKILL.md instructs installing @membranehq/cli globally via npm (npm install -g). This is a reasonable way to get the required CLI, but global npm installs carry supply-chain and privilege considerations—this should be verified (source, package version, publisher).
Credentials
The skill declares no required environment variables and the documentation explicitly says Membrane handles credentials server-side. It does not request unrelated secrets. This is proportionate to the claimed functionality.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request permanent presence or system-level configuration changes. There is no evidence it modifies other skills or agent-wide settings.
Assessment
This skill appears to do what it says: it relies on the Membrane CLI to access 1msg and does not ask for extra credentials. Before installing or using it: (1) Verify the @membranehq/cli package and its publisher (check the official GitHub/release page and pin a known-good version) since SKILL.md asks you to run npm install -g; (2) prefer non-global installs or containerized use if you worry about global npm side effects; (3) review what a Membrane connection grants (what accounts/permissions you'll authorize in the browser login); (4) be cautious when running membrane request with arbitrary paths — it can call any endpoint exposed by the connector; and (5) correct the metadata mismatch (declare the required 'membrane' binary) before trusting automated installers or tooling that rely on registry metadata.Like a lobster shell, security has layers — review code before you run it.
latestvk97fmhyz3h64v8asshbvt3sb4x84329f
License
MIT-0
Free to use, modify, and redistribute. No attribution required.