Bloomreach
v1.0.0BloomReach integration. Manage data, records, and automate workflows. Use when the user wants to interact with BloomReach data.
⭐ 0· 53·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description (BloomReach integration) match the instructions: all actions are routed through the Membrane CLI and Membrane's proxy, which is a reasonable design for a connector. The only minor inconsistency is that registry metadata lists no explicit requirement while the SKILL.md states a Membrane account is required.
Instruction Scope
SKILL.md is focused on installing and using the Membrane CLI, creating connections, listing actions, running actions, and using a proxy to call BloomReach APIs. It does not instruct the agent to read unrelated files, environment variables, or system configuration. The proxy capability does allow arbitrary requests to BloomReach (expected for a connector), so users must trust Membrane's handling of credentials and request routing.
Install Mechanism
There is no formal install spec in the registry (instruction-only), but the guide tells users to run `npm install -g @membranehq/cli`. Installing a globally-published npm package is common but carries standard npm-package risks — verify package provenance (publisher, npm page, GitHub repo) before installing, or prefer npx to avoid global installs.
Credentials
The skill requests no environment variables and does not ask for BloomReach API keys locally; instead it relies on Membrane to handle auth. This is proportionate, though it requires trusting Membrane (and creating a Membrane account) which is mentioned in SKILL.md but not in the registry 'required' fields.
Persistence & Privilege
The skill is not always-enabled and does not request persistent system privileges or modify other skills. It is instruction-only and relies on a CLI the user installs; there is no implicit persistent agent-side component declared.
Assessment
This skill is coherent for connecting to BloomReach via Membrane, but before installing or using it: 1) Verify the Membrane CLI package (@membranehq/cli) on npm and its GitHub repository to confirm the publisher and review code/permissions. 2) Prefer using npx or a local install if you want to avoid a global npm install. 3) Understand that authentication and API requests are proxied through Membrane—read Membrane's privacy/security docs so you know where credentials live and how requests are logged. 4) Be cautious when using the proxy command to send arbitrary endpoints; only run calls you expect and review responses. 5) If you need higher assurance, ask the skill author for a signed source or a published registry entry that declares the Membrane dependency and the exact commands the agent will run.Like a lobster shell, security has layers — review code before you run it.
latestvk974b9rcygzs9gf703y500qg1h84abnq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.