Shoprocket
v1.0.2Shoprocket integration. Manage Organizations. Use when the user wants to interact with Shoprocket data.
⭐ 0· 115·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Shoprocket integration) align with the instructions: all actions are performed via the Membrane CLI and Membrane proxy to the Shoprocket API. Nothing in the SKILL.md asks for unrelated credentials or system-level access.
Instruction Scope
SKILL.md's runtime instructions are narrowly scoped to installing/using the Membrane CLI, logging in, creating/using connections, running actions, and proxying requests to Shoprocket. It does not instruct reading arbitrary files, scanning unrelated env vars, or exfiltrating data to other endpoints.
Install Mechanism
The skill is instruction-only (no install spec). It asks users to install the Membrane CLI via npm (global install) or npx. Installing a global npm package is a reasonable step for this integration but has the usual risks of third-party npm packages; using npx avoids a persistent global install.
Credentials
No environment variables, secrets, or config paths are requested. The SKILL.md explicitly instructs to let Membrane handle credentials and not to ask users for API keys, which is proportionate to the stated functionality.
Persistence & Privilege
The skill does not request always:true or other elevated persistence. It does not modify other skills or system-wide settings in its instructions. Normal autonomous invocation is allowed by platform defaults but is not emphasized by the SKILL.
Assessment
This skill is coherent with its purpose, but it depends on the third-party Membrane service and a CLI from npm. Before installing or using it: (1) verify you trust Membrane (review their privacy/security docs and the CLI package source), (2) prefer running one-off commands with npx rather than a global npm -g install if you want to avoid adding a persistent binary, (3) perform the browser-based Membrane login in a secure environment, and (4) be aware that Membrane will broker and store credentials server-side — if you have policy constraints about third-party access to Shoprocket data, confirm that with your organization first.Like a lobster shell, security has layers — review code before you run it.
latestvk97d8qnnansx3thg1k5bm5tp2s8429jy
License
MIT-0
Free to use, modify, and redistribute. No attribution required.