Newslit
v1.0.2Newslit integration. Manage Organizations. Use when the user wants to interact with Newslit data.
⭐ 0· 116·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The SKILL.md describes interacting with Newslit via the Membrane CLI and the skill metadata says it's a Newslit integration — the requested capabilities (network access, Membrane account/CLI) align with that purpose. Minor inconsistency: the registry lists 'required binaries: none' even though the runtime instructions require installing/using the 'membrane' CLI.
Instruction Scope
Instructions are narrowly focused on installing and using the Membrane CLI (login, create connections, list/run actions, proxy requests). They do not instruct reading arbitrary local files or exporting unrelated environment variables. The proxy feature lets you send arbitrary requests to the Newslit API via Membrane, which is expected for this integration.
Install Mechanism
No install spec is embedded in the registry (instruction-only), but the SKILL.md tells users to run 'npm install -g @membranehq/cli' or use 'npx'. This is a public npm package (traceable) — moderate-risk compared to built-in binaries but expected for a CLI-based integration. If you distrust installing global npm packages, use 'npx' or run the CLI in an isolated environment.
Credentials
The skill does not request any environment variables, secrets, or unrelated credentials. It deliberately delegates auth to Membrane and even advises not to ask users for API keys — this is proportionate to the stated purpose. Be aware that using Membrane means trusting that service with access to Newslit credentials and proxied requests.
Persistence & Privilege
The skill is not 'always' enabled and does not request elevated persistence or cross-skill config changes. It is user-invocable and can run autonomously by default (platform standard), which is appropriate for such a connector.
Assessment
This skill is coherent: it tells you to install and use the Membrane CLI to talk to Newslit and does not ask for unrelated secrets. Before installing: (1) confirm you're comfortable installing a global npm package or prefer using 'npx' or a containerized CLI; (2) understand that Membrane will broker authentication and thus will have access to the Newslit connection and proxied requests — review Membrane's privacy/security terms if you need to limit exposure; (3) note the small metadata mismatch (the registry didn't mark the 'membrane' binary as required even though the instructions need it). If you are uneasy, run the Membrane CLI in an isolated environment or inspect the '@membranehq/cli' package source before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk975pmc715th6fncgp7gq512gh84301s
License
MIT-0
Free to use, modify, and redistribute. No attribution required.