Signalfx
v1.0.2SignalFx integration. Manage data, records, and automate workflows. Use when the user wants to interact with SignalFx data.
⭐ 0· 78·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (SignalFx integration) matches the instructions: discover connectors, create connections, run actions, and proxy SignalFx API calls via the Membrane CLI. There are no unrelated required env vars, binaries, or config paths.
Instruction Scope
SKILL.md is focused on running the Membrane CLI (login, connect, action list/run, request proxy). It does not instruct reading arbitrary system files or unrelated env vars. One important behavioral note: proxying requests with `membrane request` sends API traffic through Membrane's servers (so data and credentials are handled server-side by Membrane).
Install Mechanism
No install spec in the registry (instruction-only), but the doc tells the user to run `npm install -g @membranehq/cli`. This is a normal approach but carries typical npm/supply-chain risk—verify the package scope (@membranehq) and package integrity before installing.
Credentials
The skill declares no required environment variables or credentials, and explicitly advises not to collect API keys locally. However, using the skill requires a Membrane account and grants Membrane proxy access to SignalFx on your behalf; that is a legitimate but material delegation of sensitive access to a third party.
Persistence & Privilege
The skill is not always-enabled, doesn't request persistent system-level presence, and does not ask to modify other skills or global agent settings.
Assessment
This skill appears to do what it says (it delegates SignalFx interactions to the Membrane CLI). Before installing or using it, verify you trust Membrane (getmembrane.com) and the @membranehq npm package: check the npm publisher, inspect the package/repository if possible, and consider using a limited/test SignalFx account. Remember that requests are proxied through Membrane’s servers (so sensitive data and credentials are handled by that third party), and be cautious with installing global npm packages from any source.Like a lobster shell, security has layers — review code before you run it.
latestvk979qgztadm3jjhzpvc5r697f9843wmr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.