Roll
v1.0.2Roll integration. Manage Organizations. Use when the user wants to interact with Roll data.
⭐ 0· 131·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill claims to integrate with Roll via the Membrane platform and all runtime instructions reference the Membrane CLI and a Roll connector — this is coherent. Minor oddities: the SKILL.md contains a 'Dice / Rolls' section that looks like a template leftover, and the 'official docs' URL points to roll20.zendesk.com (a tabletop-gaming site) which likely is incorrect for a payroll product. Homepage and repository point at Membrane which aligns with the chosen integration path.
Instruction Scope
Instructions are narrowly scoped to installing and using the Membrane CLI (login, create/connect, list actions, run actions, proxy requests). They do not ask for unrelated files or environment variables. One important capability: 'membrane request' lets you proxy arbitrary API calls through a connection—this is expected for an integration but means the CLI can be used to access any endpoints the connected account permits, so review connector permissions before use.
Install Mechanism
This is an instruction-only skill (no install spec in the registry). The guide recommends 'npm install -g @membranehq/cli' which is a standard way to obtain the CLI. Because the skill does not itself pull or execute code, the install risk is limited to following the written CLI install instructions; consider using 'npx' or a local install if you want to avoid a global npm package.
Credentials
The skill declares no required environment variables or credentials and explicitly advises letting Membrane handle auth (so the skill doesn't request API keys). This is proportional to its stated purpose. There are no unexpected credential requests in the instructions.
Persistence & Privilege
The skill is not 'always: true' and does not request persistent system-level privileges. It relies on the Membrane CLI and normal browser-based authentication flow. Note that autonomous invocation is permitted by default on the platform (disable-model-invocation is false) — this is normal and not by itself a red flag.
Assessment
This skill is an instructions-only integration that uses the Membrane CLI to access a Roll connector. Before installing or running the commands: (1) verify the correct official Roll documentation link (the SKILL.md's 'official docs' URL looks wrong), (2) confirm you trust @membranehq/cli and consider using 'npx' or a local install instead of a global npm -g install, (3) when you create/connect a Roll account, review the connector's permissions — the 'membrane request' proxy can call arbitrary endpoints allowed by that connection, so avoid connecting high-privilege or production accounts unless necessary, and (4) if you have doubts about the source, check the referenced repository/homepage and the connector provider before authorizing access.Like a lobster shell, security has layers — review code before you run it.
latestvk979qbw5tmnvzxx17xda45s2w9843xae
License
MIT-0
Free to use, modify, and redistribute. No attribution required.