Firmao
v1.0.2Firmao integration. Manage Organizations, Users. Use when the user wants to interact with Firmao data.
⭐ 0· 99·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill declares a Firmao integration and all runtime instructions use the Membrane CLI and Membrane connections to call Firmao APIs — this aligns with the described purpose. No unrelated credentials, binaries, or config paths are requested.
Instruction Scope
SKILL.md only instructs installing/using the Membrane CLI, logging in, creating/using connections, running pre-built actions, and proxying requests to Firmao. It does not ask the agent to read arbitrary files, environment variables, or send data to unexpected endpoints. The guidance to prefer Membrane for auth is consistent with the integration model.
Install Mechanism
There is no built-in install spec in the skill bundle (instruction-only), but SKILL.md tells users to run `npm install -g @membranehq/cli`. Installing a global npm CLI is a normal approach but carries the usual risk of executing third-party code on the host — verify the package provenance and prefer scoped or sandboxed environments if you're cautious.
Credentials
The skill requires no environment variables or secrets in the manifest; authentication is handled by Membrane's login flow. That is proportionate to the stated purpose. Users should be aware that Membrane will hold/refresh credentials server-side once a connection is created.
Persistence & Privilege
The skill is not always-enabled and does not request elevated persistence or modification of other skills or system-wide settings. Autonomous invocation is allowed by default (platform default) and is not by itself a problem here.
Assessment
This skill is internally consistent: it uses the Membrane CLI to proxy calls to Firmao and asks you to sign in via Membrane rather than provide API keys. Before installing, verify the @membranehq/cli npm package and the Membrane service (review their GitHub/NPM pages and privacy/security docs). If you prefer minimizing host changes, consider running the CLI in a contained environment (container or VM) rather than installing it globally. Remember that creating a connection will grant Membrane access to your Firmao data — confirm you trust the Membrane service and its account handling.Like a lobster shell, security has layers — review code before you run it.
latestvk9726as1j1qgg7xyjv2syvs54d842z8v
License
MIT-0
Free to use, modify, and redistribute. No attribution required.