Supernotes
v1.0.2Supernotes integration. Manage Notes, Users, Groups. Use when the user wants to interact with Supernotes data.
⭐ 0· 94·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description describe a Supernotes integration and the SKILL.md exclusively documents using the Membrane CLI to discover and run Supernotes actions. Requested capabilities (network access, a Membrane account, Membrane CLI) match the stated purpose.
Instruction Scope
Instructions are limited to installing/using the Membrane CLI, creating connections, running actions, and proxying requests to the Supernotes API. This is in-scope, but the proxy feature allows arbitrary API requests through Membrane (expected for an integration) — users should understand that granting a connection gives Membrane access to their Supernotes data and ability to perform arbitrary calls permitted by the connector.
Install Mechanism
No install spec in the skill bundle (instruction-only). The SKILL.md directs installing @membranehq/cli via npm -g or using npx. Using npm global installs writes packages to the host; npx is provided as an alternative. This is a normal install vector for a CLI but has the usual npm risks (trusting the package author).
Credentials
The skill declares no required env vars or credentials. It relies on Membrane's browser-based auth flow rather than asking for API keys, which is proportionate to the stated functionality.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request permanent/global privileges or modify other skills. Normal autonomous invocation is allowed by platform defaults but not elevated here.
Assessment
This skill is instruction-only and uses the Membrane CLI to interact with Supernotes; that is coherent. Before installing or using it: (1) confirm you trust Membrane/@membranehq (the CLI package) because installing via npm runs third-party code; (2) understand that creating a connection grants Membrane access to your Supernotes account and lets the CLI proxy arbitrary API calls on your behalf—review connector permissions and Membrane's privacy/security docs; (3) prefer using npx if you want to avoid a global npm install; and (4) run these commands in an environment you control (not a sensitive host) and only after you explicitly approve browser-based authentication.Like a lobster shell, security has layers — review code before you run it.
latestvk973syhdpjy1p41qz6aaa9sqrs84210e
License
MIT-0
Free to use, modify, and redistribute. No attribution required.