Flexport
v1.0.0Flexport integration. Manage data, records, and automate workflows. Use when the user wants to interact with Flexport data.
⭐ 0· 53·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Flexport integration) match the SKILL.md: all runtime instructions are about discovering and running Flexport actions via the Membrane platform. No unrelated credentials, binaries, or platform access are requested.
Instruction Scope
Instructions are scoped to installing and using the Membrane CLI, creating connections, listing actions, running actions, and proxying requests to the Flexport API. They require network access and browser-based auth but do not instruct reading arbitrary files or exfiltrating data beyond the stated integration.
Install Mechanism
There is no automated install spec in the registry (skill is instruction-only), but SKILL.md tells users to run a global npm install (npm install -g @membranehq/cli). Installing a global npm package from the public registry is common and traceable, but it does execute third-party code on the host and can be riskier than instruction-only usage without local installs.
Credentials
The skill declares no required environment variables or credentials and explicitly recommends using Membrane's connection flow rather than asking for API keys. This is proportionate, but it means you must trust Membrane (their service will hold/refresh Flexport credentials and proxy requests).
Persistence & Privilege
always is false and there are no config paths or persistent privileges requested by the skill. The skill is user-invocable and can be used by the agent when invoked, which matches normal behavior.
Assessment
This skill is internally consistent and appears to do what it says: use Membrane to interact with Flexport. Before installing or following the SKILL.md steps, consider: (1) Trust — Membrane will hold OAuth tokens/credentials for Flexport and proxy requests, so review Membrane's reputation, privacy, and access controls. (2) Install risk — the guide recommends a global npm install; prefer installing tools in a virtual environment or verifying the @membranehq/cli package on npm/GitHub first, and avoid running installs as root. (3) Least privilege — create a Membrane/Flexport account with only the permissions needed for the task. (4) If you need stronger guarantees, ask for more detail from the publisher (package source, permission scopes used during connection).Like a lobster shell, security has layers — review code before you run it.
latestvk974q0ftmzf06c3055adxchdyh84d2q9
License
MIT-0
Free to use, modify, and redistribute. No attribution required.