Flexera

What to consider before installing: - The skill requires you to install and run the @membranehq/cli npm package (global install or npx) — verify the package and publisher (https://getmembrane.com, repo link in SKILL.md) before installing. Installing global npm packages carries supply‑chain risk. - The SKILL.md omitted runtime requirements from the registry metadata: you need npm/node, network access, and a Membrane account (browser login or headless flow). Expect the CLI to store auth tokens/config locally. - The Membrane CLI can proxy arbitrary requests to Flexera using your credentials — only use it if you trust the Membrane service and the connector configuration. Prefer reviewing the connector/action schemas and limiting the connection's permissions where possible. - If you want lower risk: run the CLI in an isolated environment/container, pin the exact CLI version (avoid unconstrained npx --latest in production), inspect the @membranehq/cli package source or its published artifacts, and confirm the repository/homepage match the publisher identity. - If you need more assurance, ask the skill publisher for a signed install spec or explicit metadata listing required binaries and where the CLI stores auth tokens; that would raise confidence that the skill's metadata and runtime behavior are consistent.