Incountry
v1.0.0InCountry integration. Manage data, records, and automate workflows. Use when the user wants to interact with InCountry data.
⭐ 0· 54·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description (InCountry integration) matches the instructions (use Membrane CLI to create connections, run actions, and proxy API requests). One minor mismatch: the registry lists no required binaries, but the SKILL.md assumes npm/node and ability to install or run a CLI (it also shows npx usage). This is expected for a CLI-driven integration but is not declared in metadata.
Instruction Scope
SKILL.md stays on-topic: it tells the agent how to install and use the Membrane CLI, how to authenticate (browser or headless flow), list actions, run actions, and proxy requests to InCountry. It does not instruct reading unrelated files, exporting environment variables, or exfiltrating data to third-party endpoints outside Membrane/InCountry.
Install Mechanism
No automated install spec is embedded in the registry (instruction-only). The doc recommends `npm install -g @membranehq/cli` and shows `npx` usage. Installing a package from npm is common and appropriate here, but global npm installs run arbitrary package code on your machine; verify the package and consider using npx or an isolated environment if you want lower risk.
Credentials
The skill requests no environment variables or secrets. The SKILL.md explicitly tells users not to provide API keys and relies on Membrane's browser-based auth and server-side credential handling, which is proportionate to the stated purpose.
Persistence & Privilege
The skill is not always-enabled and does not request persistent system-wide privileges or modify other skills. Autonomous invocation is allowed (platform default) but there is no additional privileged behavior requested.
Assessment
This skill appears to do what it says: it documents using the Membrane CLI to manage InCountry data and does not demand extra secrets. Before installing: (1) verify the @membranehq/cli npm package and its publisher (review the npm page and repository) because global npm installs can execute arbitrary code; prefer npx or local installs in a container/VM if you want to avoid a global install; (2) confirm you are comfortable routing requests and data through Membrane (they proxy calls and handle credentials server-side); (3) use the provided headless flow for non-GUI environments and never paste sensitive keys into chat — the skill explicitly advises against requesting API keys. If you want higher assurance, inspect the Membrane CLI code or run it in an isolated environment before using it with production data.Like a lobster shell, security has layers — review code before you run it.
latestvk97acvqq9s38nmm6a1hjd7t4q5844w5x
License
MIT-0
Free to use, modify, and redistribute. No attribution required.