Thanksio
v1.0.2Thanks.io integration. Manage Persons, Organizations, Addresses, Campaigns, Orders. Use when the user wants to interact with Thanks.io data.
⭐ 0· 96·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description map to a Thanks.io integration and the SKILL.md consistently instructs the agent to use the Membrane CLI to call Thanks.io endpoints. Network access and a Membrane account are reasonable requirements for this purpose.
Instruction Scope
Instructions are focused on using the Membrane CLI (login, connect, list/run actions, proxy requests). They allow sending arbitrary proxied requests to the Thanks.io API via Membrane, which is expected for a proxy-style integration but grants broad request-making ability (headers, methods, body). The skill does not instruct reading unrelated local files or unrelated environment variables.
Install Mechanism
The skill is instruction-only (no automated install), but it tells users to run `npm install -g @membranehq/cli`. Installing a global npm package is a common, moderate-risk action — it modifies the system PATH and places binaries on disk. The skill does not automatically download or execute arbitrary code itself.
Credentials
No environment variables or unrelated credentials are requested. The only required authentication is a Membrane login (browser-based), which is proportional for a CLI that manages service connections and tokens.
Persistence & Privilege
Skill does not request always:true, does not modify other skills, and is not requesting atypical persistent privileges. Note that Membrane CLI will persist credentials locally as part of its normal operation.
Assessment
This skill appears to do what it claims — it uses the Membrane CLI to interact with Thanks.io. Before you install/use it: (1) Verify you trust the Membrane project (npm package @membranehq/cli and https://getmembrane.com) because the CLI will be installed globally and will store auth tokens locally. (2) Be aware that the SKILL.md allows sending arbitrary proxied HTTP requests via Membrane (method, headers, body) — use only with trusted connections and avoid passing sensitive unrelated data. (3) The skill is instruction-only; the agent will not auto-install the CLI, but if you or an automated agent run those commands they will modify your system. (4) If you need higher assurance, confirm the publisher/repository and review the Membrane CLI code or its npm package before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97fmzkc6v4m07zyn6772gnr5n84322w
License
MIT-0
Free to use, modify, and redistribute. No attribution required.