Curity
v1.0.2Curity integration. Manage data, records, and automate workflows. Use when the user wants to interact with Curity data.
⭐ 0· 78·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill is a Curity integration implemented via the Membrane platform, which is coherent with the description. However the skill metadata declares no required binaries or credentials while the instructions require installing and using the Membrane CLI and a Membrane account — a mismatch between declared requirements and actual runtime needs.
Instruction Scope
Instructions are focused on discovering actions, connecting, and proxying requests to the Curity API via Membrane. They do not ask the agent to read unrelated local files or environment variables. Important operational detail: requests are proxied through Membrane, so API calls and payloads will transit Membrane's servers (and Membrane manages authentication and token refresh).
Install Mechanism
There is no formal install spec in the registry (instruction-only). The SKILL.md instructs a global npm install (@membranehq/cli), which is a moderate-risk operation (pulls code from npm and writes binaries/config locally). The skill metadata does not declare 'npm' or 'membrane' as required binaries—this omission reduces transparency.
Credentials
The skill does not request environment variables or secrets in its metadata and the instructions explicitly discourage asking users for local API keys, instead using Membrane-managed connections. No unrelated credentials are requested by the skill itself.
Persistence & Privilege
The skill is not always-enabled and uses normal autonomous invocation defaults. It does not request elevated system-wide privileges or attempt to modify other skills. The only persistent effect mentioned is using the Membrane CLI login flow, which stores session state for the CLI (expected behavior).
Assessment
This skill appears to do what it claims: it uses Membrane to talk to Curity. Before installing, confirm you trust Membrane (https://getmembrane.com / https://github.com/membranedev) because API requests and any payloads will pass through their service. Be aware you must install the Membrane CLI (global npm install) and have network/browser access for interactive login; the skill metadata failing to list 'npm' or the 'membrane' binary is an omission to note. If you need stronger assurance, review the @membranehq/cli package code/release source, verify the repository and package maintainers, and ensure no sensitive secrets are sent to third parties except through the intended Membrane-managed connection.Like a lobster shell, security has layers — review code before you run it.
latestvk979525gwa9gnks2ee8gbsmjy58429fn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.