Engage
v1.0.2Engage integration. Manage Organizations, Pipelines, Users, Filters. Use when the user wants to interact with Engage data.
⭐ 0· 78·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill name/description (Engage: manage orgs, users, pipelines) aligns with the instructions which use the Membrane CLI to connect to an Engage connector and run actions. Minor inconsistency: the SKILL.md's 'Official docs' link points to Salesforce Pardot docs (developers.salesforce.com/docs/marketing/pardot/guide/pardot-api.html), which looks like a copy/paste error or mismatch and should be verified.
Instruction Scope
Instructions are narrowly scoped to installing @membranehq/cli, logging in, creating/locating a connection, listing actions, running actions, or proxying requests via membrane request. These are appropriate for an integration skill. Important privacy/security note: 'membrane request' and the connector flow proxy arbitrary API calls through Membrane’s servers and handle auth/refresh server-side — this means request payloads and proxied API traffic will transit Membrane; the SKILL.md explicitly recommends letting Membrane handle credentials rather than asking users for API keys.
Install Mechanism
The SKILL.md instructs the user to run `npm install -g @membranehq/cli` (public npm package). No install spec is embedded in the registry (instruction-only). Installing a global npm CLI is a normal approach but has moderate trust implications: you should verify the package name, publisher, and checksum (or inspect the package repo) before global install, especially in production environments.
Credentials
The registry lists no required environment variables or credentials, which matches the SKILL.md guidance that Membrane handles auth server-side. No unexpected secrets or config paths are requested by the skill.
Persistence & Privilege
The skill is instruction-only, always:false, and does not request persistent privileges or make changes to other skills or system-wide agent settings. Autonomous model invocation is allowed (platform default) but not combined with other high-risk factors here.
Assessment
This skill appears coherent for connecting to Engage via the Membrane CLI, but before installing: (1) verify the @membranehq/cli package and its publisher (review the npm page and GitHub repository) before running a global npm install; (2) understand that Membrane will proxy API calls and manage credentials server-side — any data you send via the connector or via `membrane request` will transit Membrane’s infrastructure, so avoid sending secrets you don't want shared with that service; (3) confirm the target API (the SKILL.md's 'Official docs' link points to Salesforce Pardot — verify whether your 'Engage' instance is Pardot or a different product); and (4) if you need stricter isolation, run CLI installs in a sandbox/container or request a read-only/test account for evaluation.Like a lobster shell, security has layers — review code before you run it.
latestvk97861z0cbm6pyk41yeg1ns5pd843m8t
License
MIT-0
Free to use, modify, and redistribute. No attribution required.