Truework
v1.0.0Truework integration. Manage data, records, and automate workflows. Use when the user wants to interact with Truework data.
⭐ 0· 90·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Truework integration) match the instructions which show how to connect to Truework via the Membrane CLI and run proxy requests or pre-built actions. The requested capabilities (discover actions, run actions, proxy requests) are consistent with a Truework integration.
Instruction Scope
SKILL.md confines runtime actions to installing/using the Membrane CLI, logging in via browser, creating connections, listing actions, and proxying requests to Truework. It does not instruct reading unrelated files or exfiltrating secrets. Note: the instructions assume availability of npm/node and a browser (or headless flow) but the skill metadata did not declare these as required binaries/environments.
Install Mechanism
This is instruction-only but tells the user to run `npm install -g @membranehq/cli`. That is a public npm package install (moderate risk compared to baked-in binaries). This is expected for a CLI-driven integration, but users should verify the npm package source and prefer installing in a controlled environment if concerned.
Credentials
No environment variables, credentials, or config paths are requested. The skill explicitly advises letting Membrane handle credentials and not asking users for API keys, which is proportionate for a proxy-based integration.
Persistence & Privilege
The skill is not always-on (always: false) and does not request any elevated or persistent system-wide privileges. It does not instruct modifying other skills or system config.
Assessment
This skill appears to do what it claims: it instructs you to use the Membrane CLI to connect to Truework and run actions or proxied API calls. Before installing: (1) verify the npm package @membranehq/cli is the official package you expect (check the package owner and repository), (2) consider installing the CLI in a controlled environment (container or VM) if you do not trust global npm installs, (3) be prepared to authenticate via a browser or headless flow (the skill requires a Membrane account), and (4) avoid entering Truework/API secrets locally because the skill recommends using Membrane connections which manage auth server-side. If you need stricter assurance, ask the skill author for the exact npm package URL/release or run the CLI install in a sandbox first.Like a lobster shell, security has layers — review code before you run it.
latestvk976bfcp52hhvtskpg2dd89qxx84h4zk
License
MIT-0
Free to use, modify, and redistribute. No attribution required.