Thoughtly
v1.0.0Thoughtly integration. Manage data, records, and automate workflows. Use when the user wants to interact with Thoughtly data.
⭐ 0· 29·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The SKILL.md describes using the Membrane CLI to connect to Thoughtly and run actions/proxied requests — this matches the stated purpose. One small mismatch: the doc includes a line saying it cannot provide an API/developer URL for Thoughtly (implying Thoughtly may not be a public API), so the skill implicitly requires a working Membrane 'Thoughtly' connector which may or may not exist for all tenants. Overall the requested capabilities (installing the Membrane CLI, creating a connection, running actions) are proportional to the described goal.
Instruction Scope
Instructions are limited to installing/using the Membrane CLI, logging in, creating a connector/connection, listing/running actions, and proxying requests to Thoughtly via Membrane. They do not instruct reading arbitrary local files, scanning the host, or exfiltrating unrelated environment variables. Note: the ability to proxy arbitrary paths to the target service is powerful — it can send arbitrary requests to the connected Thoughtly API (this is expected for a proxy feature but worth being aware of).
Install Mechanism
There is no built-in installer; the SKILL.md recommends a global npm install or npx usage of @membranehq/cli. That is a common, expected approach for a CLI-based integration and the skill does not auto-download or execute arbitrary binaries. Installing packages globally is a user action and not performed by the skill itself.
Credentials
The skill declares no required environment variables or credentials and recommends using Membrane's connection flow (browser-based OAuth) so no local API keys are requested. It does require a Membrane account and a connector for Thoughtly, which is proportional to its function. There are no surprising credential requests in the instructions.
Persistence & Privilege
The skill is instruction-only, has no install spec, does not request always:true, and does not modify other skills or system-wide settings. It relies on the Membrane service for auth/session persistence rather than storing local secrets.
Assessment
This skill is coherent: it instructs you to install and use the Membrane CLI to connect to Thoughtly and run actions. Before installing/using it, verify that: (1) you trust Membrane (https://getmembrane.com) and its privacy/security model because it will hold connector credentials server-side; (2) a Thoughtly connector actually exists for your Membrane tenant and has the expected scope — the SKILL.md hints Thoughtly may not be a public API; (3) you are comfortable installing @membranehq/cli via npm (global installs modify your environment); and (4) any proxy requests you run will execute arbitrary API calls under the connector's authority, so avoid running unreviewed request payloads or paths. If you need higher assurance, check the referenced GitHub repo and the Membrane documentation or test with a least-privilege/test account first.Like a lobster shell, security has layers — review code before you run it.
latestvk97d58555wttx6h74w9ar2gks5846c5y
License
MIT-0
Free to use, modify, and redistribute. No attribution required.