Metomic
v1.0.0Metomic integration. Manage data, records, and automate workflows. Use when the user wants to interact with Metomic data.
⭐ 0· 61·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill claims to integrate with Metomic but instructs the agent to use the Membrane CLI as a proxy/adapter to reach Metomic. Using a third‑party integration layer (Membrane) is plausible and explains the instructions, but the registry metadata lists no required binaries while the SKILL.md clearly expects npm/node and the membrane CLI to be installed — this is an internal documentation inconsistency.
Instruction Scope
SKILL.md stays within the stated purpose: it shows how to install Membrane CLI, authenticate, list/create connections, discover and run actions, and proxy API requests to Metomic. One area to note: the Membrane proxy can forward arbitrary API requests to Metomic (and possibly other upstream services), which — while expected for a proxy tool — means the operator should be aware that using the proxy can transmit arbitrary data to external endpoints.
Install Mechanism
There is no formal install spec in the registry (instruction-only), but the documentation instructs users to run `npm install -g @membranehq/cli`. Installing a global npm package is standard but carries the usual moderate risk (you should verify the package source and maintainers). No downloads from unknown URLs are suggested.
Credentials
The skill declares no required environment variables, which matches the instruction-only approach. However, it requires a Membrane account and interactive authentication; Membrane will manage credentials and may request broad access to connected SaaS services. That level of access is plausible for a connector tool but is high-privilege in practice, so users should confirm what scopes/permissions are granted during authentication.
Persistence & Privilege
The skill is instruction-only, has no install-time background agents, and does not request permanent platform privileges (always:false). Autonomous invocation is allowed (the platform default) but the skill itself does not demand elevated persistent presence or system-wide config changes.
Assessment
This skill is an instructions-only wrapper that expects you to install and use the @membranehq/cli to reach Metomic. Before installing or using it: 1) Verify you are comfortable installing a global npm package (@membranehq/cli) and confirm the package source and maintainer reputation. 2) Review Membrane’s authentication scopes and privacy policy — the CLI/proxy can access connected SaaS apps and forward arbitrary API requests, so only grant the minimum required connector access. 3) Ensure you have Node/npm available (the registry metadata didn't declare this but the SKILL.md requires it). 4) Prefer performing the first authentication from a browser you control (avoid running automatic headless flows on unknown or shared hosts). If you need higher assurance, review @membranehq/cli source code/release artifacts or perform actions through official Metomic APIs directly rather than via a third‑party proxy.Like a lobster shell, security has layers — review code before you run it.
latestvk97578xfhw0r8ckdg1x6act13584bgfw
License
MIT-0
Free to use, modify, and redistribute. No attribution required.