Tapform
v1.0.2Tapform integration. Manage Organizations, Pipelines, Users, Goals, Filters. Use when the user wants to interact with Tapform data.
⭐ 0· 129·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Tapform integration) matches the instructions: discover/connect via Membrane, list actions, run actions, and proxy API calls. No unrelated credentials, binaries, or capabilities are requested.
Instruction Scope
SKILL.md only instructs using the Membrane CLI to authenticate, create connections, list/run actions, and proxy requests to Tapform. It does not direct reading local files or unrelated environment variables, nor does it instruct sending data to unexpected endpoints (requests are proxied via Membrane as documented).
Install Mechanism
This is an instruction-only skill (no install spec). It recommends installing @membranehq/cli globally via npm (npm install -g). That is a reasonable, common approach but has the usual trade-offs of global npm installs; there is no packaged install in the registry itself and no archive downloads embedded in the skill.
Credentials
The skill declares no required environment variables or credentials and explicitly instructs not to request API keys from users, relying on Membrane-managed connections instead. No excessive secrets or config paths are requested.
Persistence & Privilege
The skill is not always-enabled and does not request system-wide persistence or modify other skills' configs. It relies on the Membrane CLI and normal user authentication flows.
Assessment
This skill appears coherent and uses the Membrane CLI as its intended integration layer. Before installing: prefer running with npx (npx @membranehq/cli) or review the CLI package on npm/github instead of always doing a global npm install; verify you trust Membrane/GetMembrane as the proxy that will hold/refresh your Tapform credentials; be aware that proxying arbitrary requests via Membrane will forward any data you send to the Tapform API (so don't send secrets unrelated to the task). If you need stronger assurance, inspect the @membranehq/cli source and confirm required OAuth scopes when you authenticate.Like a lobster shell, security has layers — review code before you run it.
latestvk97fan3pn20mat33tn284mw515843v87
License
MIT-0
Free to use, modify, and redistribute. No attribution required.