Infisical
v1.0.0Infisical integration. Manage data, records, and automate workflows. Use when the user wants to interact with Infisical data.
⭐ 0· 63·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the instructions: the skill uses Membrane to interact with Infisical (connectors, actions, proxy). It does not ask for unrelated credentials or system privileges beyond network access and a Membrane account which the SKILL.md explicitly calls out.
Instruction Scope
The SKILL.md instructs the agent/operator to install and run the Membrane CLI, create connections, list actions, run actions, and optionally proxy raw requests to the Infisical API via Membrane. These steps stay within the stated purpose, but they do direct the operator to perform global npm installs and to perform browser-based authentication flows (including headless code-complete flows) and to proxy arbitrary API paths through Membrane — which requires trusting Membrane to handle and forward requests and secrets correctly.
Install Mechanism
There is no install spec in the registry (instruction-only), but the SKILL.md tells users to run `npm install -g @membranehq/cli` or use npx. Because the skill does not itself install code, risk is limited to an operator following the written instructions. Still, a global npm install changes the system environment and should be done only if the operator trusts the upstream package (@membranehq/cli).
Credentials
The skill requests no environment variables or secrets in the registry. Authentication is delegated to Membrane (browser login or headless completion), which is proportionate for a connector-based integration. There are no requests for unrelated credentials or system config paths.
Persistence & Privilege
The skill is not always-enabled and is user-invocable. It does not request persistent system-wide changes, nor does it declare changes to other skills or agent configs. Autonomous invocation is allowed (platform default) and is not combined with other red flags.
Assessment
This skill is coherent, but before installing or following its instructions: 1) Confirm you trust Membrane (@membranehq/cli) and review its package/repository and privacy policy; 2) Be aware `npm install -g` modifies your system PATH — prefer using npx or a scoped install if you want to avoid global changes; 3) The skill relies on browser-based auth and Membrane's proxy to forward requests and auth headers — only connect accounts you trust and avoid pasting secrets into chat; 4) When creating connections, check the connector and connection IDs and their permissions so you grant only necessary access; 5) If you need a higher assurance, audit the Membrane CLI source or run actions manually rather than allowing an agent to run commands autonomously.Like a lobster shell, security has layers — review code before you run it.
latestvk979yaycb6a8gqx5sy5jgp2gwd849619
License
MIT-0
Free to use, modify, and redistribute. No attribution required.