Pusher
v1.0.2Pusher integration. Manage data, records, and automate workflows. Use when the user wants to interact with Pusher data.
⭐ 0· 72·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Pusher integration) matches the instructions (use Membrane CLI to create a Pusher connection, list actions, run actions, or proxy requests). There are no unrelated environment variables, binaries, or config paths requested.
Instruction Scope
SKILL.md only instructs installing and using the Membrane CLI, logging in (browser flow or headless code completion), creating connections, listing actions, running actions, and proxying API requests — all within the stated Pusher integration scope. It does not instruct reading arbitrary files or exfiltrating data outside Membrane/Pusher flows.
Install Mechanism
There is no platform install spec (instruction-only), but the skill tells users to run `npm install -g @membranehq/cli` or use `npx`. Installing a global npm package is a normal approach but carries the usual risks of running third-party npm packages; verify the package and prefer `npx` or scoped installs if you want to avoid global installs.
Credentials
The skill requests no local env vars or secrets. Authentication is delegated to Membrane (server-side). This is proportionate, but be aware that granting Membrane access to your Pusher account can provide that service with broad access — review the scopes/permissions Membrane requests and consider using limited-service accounts.
Persistence & Privilege
The skill does not request persistent privileges (always:false) and does not modify other skills or global agent settings. Autonomous invocation is enabled (platform default) but not combined with other concerning flags.
Assessment
This skill appears to do what it says: it instructs you to install and use the Membrane CLI to connect to Pusher. Before using it, verify the @membranehq/cli package and GitHub repo are legitimate, prefer `npx` or a non-global install if you want to avoid a global npm package, and review the permissions/scopes you grant during the Membrane login flow (use a least-privilege Pusher account where possible). If you do not trust Membrane or need to keep Pusher credentials local, do not follow the connection flow — instead use an alternative integration you control. Finally, remember that the agent can invoke the skill when asked (normal behavior); only combine this skill with automation you trust.Like a lobster shell, security has layers — review code before you run it.
latestvk97amv1vs9fk5215sxg0psf8nx84224a
License
MIT-0
Free to use, modify, and redistribute. No attribution required.