Cronofy
v1.0.0Cronofy integration. Manage data, records, and automate workflows. Use when the user wants to interact with Cronofy data.
⭐ 0· 63·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description claim a Cronofy integration and the SKILL.md consistently instructs use of the Membrane CLI to connect to Cronofy, list actions, and proxy requests — these requirements match the stated purpose.
Instruction Scope
Instructions focus on using the Membrane CLI (login, connect, action list/run, request proxy). They require network access and a Membrane account and will open a browser for user auth. The docs explicitly avoid asking for raw API keys. No instructions ask for unrelated files, system-wide credentials, or shady data exfiltration, but the skill relies on a third-party (Membrane) having access to calendar data via its connections.
Install Mechanism
There is no formal install spec in the registry, but the SKILL.md instructs a global npm install (@membranehq/cli) or using npx. Installing an npm package globally is an expected approach here but carries the normal supply-chain risk of running code from npm; users should verify the package and publisher before installing.
Credentials
The skill declares no required env vars or credentials and the instructions explicitly state that Membrane manages auth server-side, so no disproportionate local secrets are requested. The user must sign into their Membrane account and complete browser-based OAuth flows.
Persistence & Privilege
The skill is instruction-only, does not request always:true, and doesn't ask to modify other skills or system-wide settings. It does not request elevated or persistent local privileges.
Assessment
This skill appears to do what it says: it uses the Membrane CLI to manage Cronofy connections and call Cronofy APIs. Before installing, verify the @membranehq/cli package and publisher on npm (or prefer the npx invocation to avoid a global install), understand that authenticating will grant Membrane access to your calendar data (so review what permissions you approve during the OAuth flow), and only proceed if you trust Membrane as the intermediary. If you need a fully self-hosted or direct Cronofy integration, consider implementing direct API calls instead of relying on a third-party proxy.Like a lobster shell, security has layers — review code before you run it.
latestvk97bz0rsgm81782dhc9q1s5t31844bj7
License
MIT-0
Free to use, modify, and redistribute. No attribution required.