Liferay
v1.0.2Liferay integration. Manage data, records, and automate workflows. Use when the user wants to interact with Liferay data.
⭐ 0· 49·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill claims to integrate with Liferay and its SKILL.md consistently instructs the agent to use the Membrane CLI and Membrane connections/proxy to interact with Liferay. Required artifacts (CLI usage, login, connection creation, action listing/running, proxy requests) match the described purpose; there are no unrelated environment variables, binaries, or config paths requested.
Instruction Scope
Instructions are concrete and limited to installing the Membrane CLI, authenticating with Membrane, creating/using a Liferay connection, discovering actions, running actions, and proxying API requests through Membrane. The SKILL.md does not instruct reading arbitrary local files, scanning system config, or exfiltrating data elsewhere beyond Membrane's services.
Install Mechanism
This is an instruction-only skill (no install spec), but it tells users to install @membranehq/cli globally via npm (npm install -g). That is expected for a CLI-driven workflow but does have side effects at the system level (global npm package install) and requires the user to trust the upstream npm package and its publisher.
Credentials
The skill requests no local credentials, which is appropriate, but it depends on the Membrane service to manage auth and to proxy requests to Liferay. That means Liferay API calls and potentially sensitive data will transit Membrane's infrastructure (getmembrane.com). Although not an outright mismatch, this is a privacy/trust consideration: the skill's behavior is proportionate to its function but relies on a third party.
Persistence & Privilege
The skill is not always-enabled and doesn't request special platform privileges. The only persistent effects are those of installing and using the Membrane CLI (which will store connection state/config locally as part of normal CLI operation). Autonomous invocation is enabled by default on the platform but that alone is not a red flag here.
Assessment
This skill appears to do what it says: it uses the Membrane CLI to interact with Liferay and requests no unrelated credentials. Before installing/using it, consider: (1) you will need to install a global npm package (@membranehq/cli); (2) Liferay requests and data will be proxied through Membrane (getmembrane.com) — ensure you trust that service and that routing data through a third party is allowed by your organization/privacy requirements; (3) verify the Membrane package and the referenced repository/homepage if you need higher assurance; (4) run initial tests in a low‑privilege or isolated environment and review what actions the skill will invoke before automating them. If you need the agent to operate without routing data through a third party, this skill is not suitable.Like a lobster shell, security has layers — review code before you run it.
latestvk972n5s6phnfqc6fgjm2cw2575842e07
License
MIT-0
Free to use, modify, and redistribute. No attribution required.