Lamden
v1.0.0Lamden integration. Manage blockchain and crypto data, records, and workflows. Use when the user wants to interact with Lamden data.
⭐ 0· 51·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
The name/description say 'Lamden integration' and the SKILL.md exclusively describes using the Membrane CLI to discover/connect to Lamden and run actions or proxied requests. No unrelated services, credentials, or binaries are requested; the required capabilities align with the stated purpose.
Instruction Scope
Instructions are scoped to installing/using the Membrane CLI, performing browser-based login, creating connections, listing and running actions, and proxying HTTP requests through Membrane. They do not instruct reading local files or unrelated environment variables. Note: the 'membrane request' proxy allows sending arbitrary paths/requests through Membrane — expected for a connector but worth awareness because it routes requests and payloads via Membrane's servers.
Install Mechanism
The registry has no formal install spec (instruction-only), but SKILL.md tells the user to run 'npm install -g @membranehq/cli' and uses 'npx @membranehq/cli@latest'. That is a reasonable, common approach for CLI-based connectors, but executing npm-installed CLIs runs third-party code from the npm registry (moderate risk).
Credentials
The skill declares no required env vars or credentials and recommends using Membrane's server-side auth rather than local API keys. This is proportionate, but it centralizes trust in Membrane (they will hold/refresh tokens and see proxied requests).
Persistence & Privilege
always is false and there is no install script or requests to modify other skills or system-wide configs. The skill is user-invocable and can be called autonomously by the agent (platform default) but there's no additional persistence or elevated privilege requested.
Assessment
This skill is coherent for Lamden work, but take these practical steps before installing or using it: 1) Verify the Membrane CLI package (@membranehq/cli) and its publisher (review the npm package page and the referenced GitHub repo) before running global installs or npx to avoid executing untrusted code. 2) Understand that Membrane will act as a proxy and hold/refresh your Lamden credentials — review Membrane's privacy/security docs and the connector's scopes before connecting. 3) Avoid sending private keys or other secrets as raw payloads through the proxy; prefer the standard connection/auth flow. 4) Consider installing the CLI in an isolated environment (container/VM) if you want to limit risk from third-party CLIs. If you want me to, I can list the exact commands and checks to verify the npm package and GitHub repo before you proceed.Like a lobster shell, security has layers — review code before you run it.
latestvk97073xk1wfqzwh02xv3q0773584djhy
License
MIT-0
Free to use, modify, and redistribute. No attribution required.