Onethread
v1.0.0Onethread integration. Manage data, records, and automate workflows. Use when the user wants to interact with Onethread data.
⭐ 0· 30·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Onethread integration) matches the instructions: all actions are performed via the Membrane CLI and Membrane's proxy to Onethread. No unrelated credentials, binaries, or system paths are requested.
Instruction Scope
SKILL.md stays on-topic (install CLI, login via Membrane, create/connect a connector, run actions or proxy requests). It does instruct the user/agent to send arbitrary proxy requests through Membrane to the Onethread API — powerful but expected for this integration. It does not tell the agent to read unrelated files or harvest local secrets.
Install Mechanism
There is no formal install spec in the registry (instruction-only), but SKILL.md directs installing @membranehq/cli via npm -g. Global npm installs carry the usual supply-chain risks; however, this is proportionate to using the Membrane CLI.
Credentials
No environment variables, secrets, or config paths are requested by the skill. Authentication is delegated to Membrane as documented, which aligns with the skill's purpose.
Persistence & Privilege
always is false, no install spec writes files in the registry, and the skill does not request system-wide config access. The skill can be invoked autonomously (default), which is normal for skills and not excessive here.
Assessment
This skill is instruction-only and coherent: it relies on the Membrane CLI to authenticate and proxy requests to Onethread. Before installing or using it, consider: (1) the CLI is installed via npm -g—verify the @membranehq/cli package (publisher, version, and repository) and prefer npx/local install if you want to avoid a global install; (2) authentication opens a browser flow and Membrane holds credentials server-side—ensure you trust Membrane/getmembrane.com for storing/refreshing access; (3) the Membrane proxy can send arbitrary API requests to Onethread, so be deliberate about what actions you run (read vs write); (4) network access is required; (5) if you need stricter controls, verify the connector permissions in your Membrane tenant and review the Membrane CLI source on the repo before use.Like a lobster shell, security has layers — review code before you run it.
latestvk97bt13pkw62na1mvmb009qpxx846r8z
License
MIT-0
Free to use, modify, and redistribute. No attribution required.