Timebuzzer
v1.0.0TimeBuzzer integration. Manage data, records, and automate workflows. Use when the user wants to interact with TimeBuzzer data.
⭐ 0· 93·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description (TimeBuzzer integration) align with the runtime instructions: all actions use Membrane to connect to TimeBuzzer, discover actions, run actions, or proxy API requests. There are no unrelated credentials, binaries, or paths requested.
Instruction Scope
The SKILL.md instructs the agent/user to install and run the Membrane CLI, perform browser-based login, create connections, list actions, run actions, and proxy API requests. These instructions stay within the stated purpose, but they also assume the environment can install and run npm/global binaries and that the user will complete OAuth flows. The doc does not instruct reading unrelated local files or env vars, but it does omit an explicit precondition that Node/npm is available and that a global install will modify the system.
Install Mechanism
There is no formal install spec in the package metadata (instruction-only), yet SKILL.md asks users to run `npm install -g @membranehq/cli` (or use npx). Installing an npm package from the public registry is common and traceable, but it does modify the host (global npm install) and requires trusting the @membranehq package. This is a moderate-risk action compared with an instruction-only skill that installs nothing.
Credentials
The skill requests no environment variables or credentials itself. It does require a Membrane account and a browser-based login flow; Membrane will hold and refresh TimeBuzzer credentials server-side. Requiring a third-party account is proportional to the stated purpose.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system-wide settings according to the provided materials, and is user-invocable. Autonomous invocation is allowed (platform default) but not accompanied by elevated persistent privileges.
Assessment
This skill is coherent: it uses the Membrane CLI to talk to TimeBuzzer and does not ask for unrelated secrets. Before installing, verify you trust the @membranehq npm package and the Membrane service (they will proxy requests and hold credentials). Note that SKILL.md assumes you can run a global npm install (requires Node/npm and permission to install global binaries) or use npx; the skill metadata does not declare that prerequisite. If you are uncomfortable installing or trusting a third-party CLI, you should not install the CLI or should audit the @membranehq package first. Also be aware that using the proxy means requests to TimeBuzzer go through Membrane’s servers, so review their privacy/security terms if that matters for your data.Like a lobster shell, security has layers — review code before you run it.
latestvk97cf9nhtfx866dgrdq9zddbh984gwd3
License
MIT-0
Free to use, modify, and redistribute. No attribution required.