Smugmug
v1.0.2SmugMug integration. Manage Users. Use when the user wants to interact with SmugMug data.
⭐ 0· 142·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description say 'SmugMug integration' and the instructions exclusively describe using the Membrane CLI and Membrane connections to call SmugMug APIs. There are no unrelated env vars, binaries, or config paths requested.
Instruction Scope
SKILL.md restricts actions to creating/using Membrane connections, listing/ running Membrane actions, and proxying requests to the SmugMug API via Membrane. It does not instruct reading local files or unrelated environment variables. It does allow arbitrary proxied API calls via Membrane (which is expected for an integration).
Install Mechanism
This is an instruction-only skill (no install spec), but it tells the user to install @membranehq/cli globally via npm (npm install -g). Global npm installs run code from the public registry and modify the system environment. That practice is typical for CLI-based integrations but carries the usual supply-chain risks; the package and publisher should be verified before installation.
Credentials
The skill requires no local secrets or env vars, which is proportionate. However, it relies on Membrane to manage auth server-side: using the skill means you will authenticate via Membrane and permit Membrane to hold/refresh SmugMug credentials and proxy requests. That is expected for this design but is an important trust/privacy consideration.
Persistence & Privilege
The skill is not always-enabled and is user-invocable. It does not request persistent system privileges or attempt to modify other skills or agent configuration.
Assessment
This skill is coherent for interacting with SmugMug via Membrane, but before installing: 1) Verify the npm package (@membranehq/cli) and its publisher on the npm registry and inspect the package/repository if possible; 2) Understand that you will log into Membrane in a browser and Membrane will hold/refresh your SmugMug credentials and see proxied API traffic — only proceed if you trust that service; 3) Prefer non-global installs or run the CLI in a sandbox if you want to limit system changes; 4) If you need higher assurance, ask the skill author for a signed release or examine the Membrane CLI source code and the listed GitHub repository before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97128rtkpwv47tcby0kdj79wd843s4h
License
MIT-0
Free to use, modify, and redistribute. No attribution required.