Nifty
v1.0.2Nifty integration. Manage Organizations. Use when the user wants to interact with Nifty data.
⭐ 0· 106·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill claims to integrate with Nifty and all runtime instructions revolve around the Membrane CLI and Membrane-managed connections to Nifty — this matches the stated purpose. However, the registry metadata declares no required binaries while the SKILL.md explicitly requires installing the @membranehq/cli, so there is a metadata/instruction mismatch that should be clarified.
Instruction Scope
The SKILL.md limits actions to installing and using the Membrane CLI: logging in, creating a connection, listing/running actions, and using Membrane's proxy to call Nifty endpoints. It does not instruct reading arbitrary local files or exfiltrating broad environment data. Proxy usage is constrained by Membrane's described base-URL behavior (requests are for the connected service).
Install Mechanism
This is an instruction-only skill (no install spec), but the runtime instructions tell the user to run `npm install -g @membranehq/cli`. Installing a global npm CLI is a common but non-trivial action (writes to the host), and the skill metadata does not declare this requirement — users should be aware they must install a third-party package themselves and verify it comes from the expected publisher.
Credentials
The skill declares no required environment variables or secrets and explicitly tells users not to provide API keys (Membrane handles auth server-side). That is proportionate to the stated purpose. Note: trusting Membrane implies the service will see/handle the user's Nifty credentials and proxied requests.
Persistence & Privilege
The skill does not request persistent/always-on privileges, does not modify other skills, and does not require system-level config paths. It operates at user-invocation level via CLI commands.
Assessment
Before installing: (1) Understand this skill expects you to install and run the @membranehq CLI (global npm install) — verify the package and publisher and consider installing in an isolated environment if you have concerns. (2) Using the skill routes requests through Membrane’s service and its stored connections — you are delegating Nifty credentials and proxied request handling to that third party, so only proceed if you trust Membrane/getmembrane.com. (3) Note the registry metadata did not list the CLI requirement — this mismatch is minor but worth confirming with the skill author or provider. If you want stronger assurance, inspect the Membrane CLI source or run interactions in a controlled/test account first.Like a lobster shell, security has layers — review code before you run it.
latestvk97ffyy6fzzxvddeevymmfy141843k78
License
MIT-0
Free to use, modify, and redistribute. No attribution required.