Hyscoreio
v1.0.0Hyscore.io integration. Manage data, records, and automate workflows. Use when the user wants to interact with Hyscore.io data.
⭐ 0· 27·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (Hyscore.io integration) match the instructions: the SKILL.md explains using the Membrane CLI to discover connectors, create connections, run actions, and proxy API requests to Hyscore.io. No unrelated services or credentials are requested.
Instruction Scope
Runtime instructions are narrowly scoped to installing and using the Membrane CLI, performing login, creating connections, listing actions, and proxying requests. The doc does not instruct reading unrelated files, exfiltrating data, or accessing unrelated env vars.
Install Mechanism
There is no automated install spec in the skill bundle (lowest risk). The SKILL.md advises a global npm install (npm install -g @membranehq/cli), which is a reasonable, expected step but requires the user to trust the npm package and may need elevated rights on some systems. Verify the CLI's origin (official @membranehq package) before installing globally.
Credentials
No environment variables, config paths, or credentials are declared or required by the skill. The instructions explicitly recommend letting Membrane handle auth and not asking users for API keys, which is proportionate to the stated purpose.
Persistence & Privilege
The skill is not always-enabled and does not request system or agent-level persistence. It's instruction-only and would rely on the user installing and running the Membrane CLI; it does not modify other skills or global agent settings.
Assessment
This skill is coherent and appears to do what it says: it guides the user to install and use the official Membrane CLI to interact with Hyscore.io. Before installing: (1) verify the npm package (@membranehq/cli) and its publisher are legitimate (check the package page and repository), (2) be aware global npm installs may require elevated permissions—prefer a local or npx invocation if you want to avoid -g, and (3) confirm you trust Membrane to broker credentials (the skill recommends letting Membrane store/manage auth server-side). If you are uncomfortable installing third-party CLIs, you can decline and use the Hyscore.io API directly instead.Like a lobster shell, security has layers — review code before you run it.
latestvk97bhp90ehnypmgye7rhjw8m2d846ycj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.