Box
v1.0.2Box integration. Manage Folders, Users, Groups, Collaborations. Use when the user wants to interact with Box data.
⭐ 0· 306·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (Box integration) align with the instructions: the skill instructs use of the Membrane CLI to discover connections, run actions, and proxy Box API requests. No unrelated env vars, binaries, or config paths are requested.
Instruction Scope
SKILL.md limits runtime activity to installing/using the Membrane CLI, logging in, creating a Box connection, listing actions, running actions, and proxying Box API calls. It does not instruct reading unrelated system files or harvesting secrets; it explicitly advises not to ask users for API keys.
Install Mechanism
The skill recommends installing @membranehq/cli via npm (-g). This is a standard public npm package install (moderate risk compared with no install). Consider using npx (the file itself already shows an npx example) or reviewing the npm package and its GitHub repo before global installation to avoid unexpected system-wide changes.
Credentials
The skill declares no required env vars or credentials. Authentication is delegated to Membrane (browser-based OAuth flow), which is appropriate for a Box connector and explains the lack of local secrets.
Persistence & Privilege
always is false and there are no install-time hooks or requests to modify other skills or system-wide agent settings. The skill does require installing a CLI tool if you follow the instructions, but it does not request elevated or persistent platform privileges.
Assessment
This skill appears to do what it says: it uses the Membrane CLI to connect to Box. Before installing: (1) verify and review the @membranehq/cli package on npm/GitHub (packages installed with npm -g run code on your system); (2) prefer using npx if you want to avoid a global install; (3) be prepared to complete browser-based OAuth flows (or handle headless flow codes); (4) confirm you trust the Membrane service (it will hold Box credentials and proxy requests); and (5) never paste Box admin secrets into chat — use the Membrane connection flow as instructed. If you want extra assurance, inspect the Membrane CLI code or use Membrane's documented signup and auth flows before proceeding.Like a lobster shell, security has layers — review code before you run it.
latestvk970wq2p6pa0n34ct1gj7n3jqd842yb4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.