Alegra
v1.0.2Alegra integration. Manage data, records, and automate workflows. Use when the user wants to interact with Alegra data.
⭐ 0· 124·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill claims to integrate with Alegra and all runtime instructions use the Membrane CLI and Membrane connections to call Alegra APIs — this matches the stated purpose. One small mismatch: the registry metadata lists no required binaries, but the SKILL.md assumes npm/node (for `npm install -g @membranehq/cli`) and a membrane CLI on PATH.
Instruction Scope
Instructions are focused: they tell the agent how to install and use the Membrane CLI, create/connect a Membrane Alegra connection, list/run Membrane actions, and proxy raw requests through Membrane. They do not instruct reading unrelated files or exfiltrating secrets and explicitly advise against asking users for API keys.
Install Mechanism
There is no formal install spec in the registry (instruction-only), but SKILL.md instructs a global npm install of @membranehq/cli. Installing an npm package is a common and reasonable step for a CLI integration, but global npm installs run code at install time (postinstall scripts) and the skill metadata should have declared the required binaries (node/npm) and/or provided an install spec.
Credentials
The skill requests no environment variables, credentials, or config paths in the metadata. It relies on a Membrane account and browser-based OAuth flows for Alegra access, which is proportionate to its purpose. The SKILL.md explicitly tells integrators not to collect API keys locally.
Persistence & Privilege
The skill is not marked always:true, does not claim to modify other skills or system-wide settings, and has no install-time scripts declared in the registry. No elevated persistence or privileges are requested in the provided materials.
Assessment
This skill appears to do what it says: it uses the Membrane CLI to access Alegra. Before installing: (1) ensure you have Node/npm and understand that the SKILL.md assumes you will run `npm install -g @membranehq/cli` (the registry metadata should declare this but does not); (2) review the @membranehq/cli package on npm and its upstream repository to confirm authenticity and check for unexpected install scripts; (3) prefer running installs in a controlled environment (container or VM) if you are cautious about global npm packages; (4) follow the Membrane OAuth browser flow rather than pasting credentials into the agent; and (5) consider asking the skill author to update registry metadata to declare required binaries and provide an explicit install spec for transparency.Like a lobster shell, security has layers — review code before you run it.
latestvk970rvkckc7pmz9ddewg5cc94h84388d
License
MIT-0
Free to use, modify, and redistribute. No attribution required.