Geokeo
v1.0.0Geokeo integration. Manage data, records, and automate workflows. Use when the user wants to interact with Geokeo data.
⭐ 0· 52·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name and description (Geokeo integration for data and workflows) match the SKILL.md instructions: all actions are performed via the Membrane CLI and/or Membrane's proxy to the Geokeo API. Nothing in the instructions asks for unrelated services or credentials.
Instruction Scope
Runtime instructions stay on-topic: install and use the Membrane CLI, create a connection to Geokeo, list and run actions, or send proxied API requests via Membrane. The guide explicitly avoids asking for raw API keys and does not instruct reading unrelated local files or environment variables.
Install Mechanism
Although there is no formal install spec in the registry metadata, SKILL.md tells users to run `npm install -g @membranehq/cli` and suggests `npx @membranehq/cli@latest`. Installing or executing code from npm is a moderate-risk action (remote code execution possibility, global install may need elevated privileges). The omission of a declared required binary in the registry metadata is an incoherence to be aware of.
Credentials
The skill does not request environment variables or credentials in metadata. It relies on Membrane to handle auth server-side and explicitly tells integrators not to ask users for API keys or tokens — this is proportional to the stated purpose. No unrelated secrets are requested.
Persistence & Privilege
The skill is instruction-only, does not request persistent system presence, and the registry flags show always:false. The skill does not instruct modifying other skills or system-wide configs.
Assessment
This skill appears coherent: it uses the Membrane CLI to access Geokeo and does not ask for extra secrets. Before installing, verify you trust the @membranehq/cli npm package and the Membrane service (review the npm package page and the vendor site/privacy docs). Prefer using npx for one-off runs if you don't want a global install, but be aware npx/@latest will fetch and execute code from the npm registry (review the package/version first). Note the registry metadata omitted declaring the Membrane CLI requirement—ensure your environment can safely install/run the CLI. Finally, remember that using Membrane gives that service access to your Geokeo account data (it will proxy requests and manage credentials), so confirm that level of access is acceptable for your organization.Like a lobster shell, security has layers — review code before you run it.
latestvk971y5rncn9bnmt96ch8pr684d84b02d
License
MIT-0
Free to use, modify, and redistribute. No attribution required.