Clayhr
v1.0.0ClayHR integration. Manage data, records, and automate workflows. Use when the user wants to interact with ClayHR data.
⭐ 0· 55·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The README-like SKILL.md consistently describes integrating with ClayHR via the Membrane CLI. The recommended actions (connect, action list/run, proxy requests) match the stated purpose and require the Membrane CLI and account — nothing extraneous is requested.
Instruction Scope
Instructions are limited to installing/using the Membrane CLI, authenticating via browser (or headless flow), listing/connecting to connectors, running actions, and proxying API requests. There are no instructions to read unrelated host files, environment secrets, or to exfiltrate data to unexpected endpoints; network access and a Membrane account are explicitly required.
Install Mechanism
The skill is instruction-only (no code files). It recommends installing @membranehq/cli via npm (-g). Installing an npm package is a standard approach but has the usual risks of third-party packages (supply-chain or malicious package names). The install method is not an arbitrary URL download or archive extraction.
Credentials
The skill declares no required environment variables or credentials. It relies on the Membrane service to manage ClayHR credentials server-side (the SKILL.md explicitly advises against collecting API keys locally), which is proportionate to the described integration.
Persistence & Privilege
always:false and no install-time modifications are requested by the SKILL.md. The skill does not ask to modify other skills or system-wide agent settings. Autonomous invocation is allowed by default (platform behavior) but is not combined with other privilege escalations.
Assessment
This skill appears internally consistent: it only instructs use of the Membrane CLI to talk to ClayHR and does not request extra credentials. Before installing, consider the following: (1) verify the @membranehq/cli npm package name and maintainer on the npm registry and review the project/repo (https://github.com/membranedev) for trustworthiness; (2) be aware you must create a Membrane account — Membrane will handle ClayHR auth server-side, so you are delegating credential storage to a third party; (3) prefer installing the CLI in a controlled environment (avoid unknown machines) and review what the CLI does (or its source) before granting it global install privileges; (4) if you require higher assurance, confirm the CLI's integrity (checksums/signature) or run it in an isolated environment. Overall, no red flags in the skill content itself, but standard due diligence on the external CLI/service is recommended.Like a lobster shell, security has layers — review code before you run it.
latestvk9763vzn7nf19wjhqj0xf867es84990p
License
MIT-0
Free to use, modify, and redistribute. No attribution required.