Decision Journal
v1.0.2Decision Journal integration. Manage Decisions, Areas, Templates. Use when the user wants to interact with Decision Journal data.
⭐ 0· 88·1 current·1 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description (Decision Journal integration) match the instructions: it instructs the agent to use the Membrane CLI to connect to a Decision Journal connector, list actions, run actions, and proxy requests. Required network access and a Membrane account are justified by this purpose; no unrelated credentials or system access are requested.
Instruction Scope
SKILL.md only directs installing/using the Membrane CLI, running membrane login and membrane action/connection/request commands, and using browser-based auth or headless completion codes. It does not instruct reading unrelated files, dumping environment variables, or exfiltrating data to third-party endpoints. (Minor odd wording in the docs: the 'Official docs: I am sorry...' line is a harmless editorial artifact.)
Install Mechanism
There is no formal install spec in the registry; the README tells the user to install @membranehq/cli via 'npm install -g'. That is a reasonable, expected instruction for this kind of integration, but it is a client-side, explicit install step with supply-chain considerations (global npm install). The registry does not itself provide or pin a package/source/checksum.
Credentials
The skill declares no required environment variables or credentials. The instructions explicitly tell users to create connections via Membrane and to avoid entering raw API keys locally. This is proportionate: Membrane is expected to manage the necessary credentials server-side.
Persistence & Privilege
always:false and default model-invocation behavior are used. The skill does not request persistent system-wide changes, nor does it instruct modifying other skills or agent settings. Autonomous invocation is allowed (platform default) and not by itself a concern.
Assessment
This skill appears coherent: it expects you to have a Membrane account and to install and use the @membranehq/cli to connect to a Decision Journal connector. Before installing or running the CLI: 1) verify the npm package (@membranehq/cli) on the npm registry and the publisher identity; prefer installing only from official sources and review package versions/changes. 2) Be aware that Membrane will act as the broker for your Decision Journal credentials and data—review Membrane's privacy and security documentation and the connector's access scope. 3) Installing a global npm package has supply-chain risk—if you are on a shared or production machine, consider a local or isolated install. 4) The skill's instructions do not request other secrets or system files, and it does not demand elevated privileges. If you need greater assurance, ask the publisher for a pinned release URL, repository commit, or package checksum before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk979jhj7r007fb94zbdxf7q38n8426ct
License
MIT-0
Free to use, modify, and redistribute. No attribution required.