Plaid
v1.0.0Plaid integration. Manage data, records, and automate workflows. Use when the user wants to interact with Plaid data.
⭐ 0· 31·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
The skill is described as a Plaid integration and all runtime instructions use the Membrane CLI/proxy to access Plaid — this matches the stated purpose. Minor mismatch: the SKILL.md instructs installing the Membrane CLI via npm, but the skill manifest lists no required binaries; the installer (npm) is therefore an implicit dependency that isn't declared.
Instruction Scope
SKILL.md stays on scope: it describes using membrane login, creating/choosing a Plaid connection, running actions, and proxying requests to the Plaid API. It explicitly advises not to ask users for Plaid API keys and does not instruct reading unrelated files or environment variables.
Install Mechanism
There is no platform install spec in the registry; the instructions advise running `npm install -g @membranehq/cli` or using npx. Installing a global npm package runs code from the public npm registry (expected for a CLI) — reasonable for this use case but carries the usual npm risks (install scripts, supply-chain).
Credentials
The skill requests no local environment variables or credentials and relies on Membrane to manage Plaid auth. This is proportionate, but it does mean you must trust Membrane: Membrane's servers will see and manage your Plaid credentials and proxied banking data, which is a privacy/Trust consideration the user should accept before use.
Persistence & Privilege
Skill flags are ordinary (always: false, user-invocable true). There is no request for persistent system-level privileges or to modify other skills/configs.
Assessment
This skill appears to do what it says: it uses Membrane as a proxy to talk to Plaid rather than direct Plaid API calls. Before installing or using it: (1) Understand that you must create/login to a Membrane account and that Membrane will hold the connection/credentials and see proxied Plaid data — review Membrane's privacy/security docs and confirm you trust the service. (2) The SKILL.md tells you to install @membranehq/cli from npm; installing global npm packages can run install-time code — consider using npx or pinning a specific version, and inspect the package repository if you want to audit it. (3) Check the connector scopes/permissions during connect (grant least privilege) and avoid entering any local Plaid API keys into the agent or prompts; follow the described browser-based OAuth/connection flow. If you want higher assurance, verify the @membranehq/cli source on GitHub and confirm the referenced repository/homepage before proceeding.Like a lobster shell, security has layers — review code before you run it.
latestvk97dy7dsa7dgzxjxzybqn0tsjs846g1q
License
MIT-0
Free to use, modify, and redistribute. No attribution required.