M3Ter
v1.0.0M3ter integration. Manage data, records, and automate workflows. Use when the user wants to interact with M3ter data.
⭐ 0· 68·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill claims to provide M3ter integration and the SKILL.md consistently instructs the agent to use the Membrane CLI and Membrane-hosted connections to access M3ter. One small mismatch: registry metadata declares no required binaries or tools, but the instructions explicitly require npm (to install a global CLI) and the `membrane` binary. This is a minor documentation gap, not a functional incoherence.
Instruction Scope
All runtime instructions are limited to installing/using the Membrane CLI, logging in via browser/headless flow, creating/using Membrane connections, listing and running actions, and proxying requests to the M3ter API via Membrane. The doc does not instruct reading unrelated files, exporting local secrets, or contacting unexpected endpoints outside Membrane and M3ter. It also explicitly advises not to ask users for API keys (letting Membrane handle creds).
Install Mechanism
There is no automated install spec in the skill (instruction-only). The SKILL.md recommends `npm install -g @membranehq/cli`, which is a reasonable but non-zero risk action (global npm installs require local privileges and pull code from the public npm registry). Because the skill does not perform the install itself, it's lower-risk than an automatic download, but users should verify the CLI package origin and integrity before installing.
Credentials
The skill requests no environment variables or local credentials; it relies on Membrane-managed connections and browser-based auth. This is proportionate to the stated goal. Note: by design, using Membrane connections will grant Membrane access to the user's M3ter data — the user should understand and trust that service before creating connections.
Persistence & Privilege
The skill does not request always-on presence and does not modify system or other-skill configs. It permits normal autonomous invocation (platform default). No additional persistent privileges are requested by the skill itself.
Assessment
This skill appears to be what it claims: it instructs the agent to use the Membrane CLI to manage M3ter data. Before installing or using it, consider the following: (1) verify the @membranehq/cli package and GitHub repo are official and trustworthy (npm page, maintainer, repo commits); (2) installing a global npm package requires elevated/local privileges — prefer installing in a controlled environment or using npx when possible; (3) creating a Membrane connection grants Membrane (and any authorized actions) access to your M3ter account/data — only connect accounts you trust Membrane to handle; (4) confirm you are comfortable with the browser auth flow that will be used to grant access; (5) note the minor documentation gap: the skill's metadata didn't list required binaries (npm/membrane) even though the instructions use them. If any of these are unacceptable, do not install or create connections until you validate the CLI and service.Like a lobster shell, security has layers — review code before you run it.
latestvk97bcesvtftwwnp5r6b985q9dd84bbss
License
MIT-0
Free to use, modify, and redistribute. No attribution required.