ClawHub

Marketstack

v1.0.2

Marketstack integration. Manage data, records, and automate workflows. Use when the user wants to interact with Marketstack data.

⭐ 0· 112·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
The skill claims to integrate with Marketstack and its SKILL.md exclusively describes using the Membrane CLI to manage connections and proxy requests to Marketstack — this aligns with the stated purpose. Minor mismatch: the skill metadata lists no required binaries, but the runtime instructions expect the user to install and run the `membrane` CLI (installed via `npm`) — this is a small documentation/manifest omission rather than a functional mismatch.
✓
Instruction Scope
Instructions stay on-topic: installing and using Membrane CLI, creating connections, listing actions, running actions, and proxying requests to Marketstack. They do not instruct reading unrelated system files, exfiltrating secrets, or contacting unexpected endpoints beyond Membrane/Marketstack. The doc explicitly advises not to ask users for API keys and to let Membrane handle credentials.
ℹ
Install Mechanism
There is no automated install spec in the registry (instruction-only), which is low-risk. The SKILL.md recommends a global npm install (`npm install -g @membranehq/cli`) — this is a user-driven install and not performed by the skill itself. Users should be aware that installing a global npm package writes code to their system and should verify the package source (`@membranehq/cli`).
✓
Credentials
The skill declares no required environment variables or credentials and the instructions delegate authentication to Membrane (browser-based login/connection flow). That is proportionate to the stated functionality. If you plan to use this, you will need a Membrane account, but no local secret variables are requested by the skill.
✓
Persistence & Privilege
The skill is not marked always:true and does not request to modify system or other skills' configurations. It runs via user-invoked CLI commands and does not demand persistent elevated presence.
Assessment
This skill is an instruction-only integration that relies on the Membrane CLI to talk to Marketstack. Before installing or using it: 1) Verify you trust Membrane (https://getmembrane.com and the @membranehq/cli package) because Membrane will proxy requests and manage your Marketstack credentials; 2) Installing the recommended global npm package will put third-party code on your machine—inspect the package and its source if you have concerns; 3) The SKILL.md omits declaring the `membrane` (and implicitly `npm`/Node) requirement in metadata—expect to install and run the CLI locally; 4) When proxying custom endpoints, be mindful you are sending requests (and potentially data) through Membrane's servers; only proceed if that trust model is acceptable. Overall the skill appears coherent with its stated purpose.

Like a lobster shell, security has layers — review code before you run it.

latestvk97bd1ztnzhqkdbxspd72bg8j5843306

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments