Urlboxio
v1.0.2Urlbox.io integration. Manage data, records, and automate workflows. Use when the user wants to interact with Urlbox.io data.
⭐ 0· 103·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill claims to integrate with Urlbox.io and all runtime instructions consistently use Membrane as a proxy/connector to Urlbox.io — that matches the stated purpose. However, the SKILL.md instructs installing and using the Membrane CLI (npm/npx), but the registry metadata lists no required binaries; this is an omission/inconsistency.
Instruction Scope
The instructions stay within the stated purpose: discover/connect to Urlbox via Membrane, run actions, and proxy requests. They do not instruct reading unrelated local files or exporting secrets. They explicitly advise against asking users for Urlbox API keys and rely on Membrane for auth.
Install Mechanism
There is no formal install spec in the registry (instruction-only). The SKILL.md tells users to run 'npm install -g @membranehq/cli' and uses 'npx' in examples. Installing a global npm package and running npx pulls code from the npm registry — a common but significant action that should be deliberate. The skill did not declare npm/node as a required binary.
Credentials
The skill declares no required environment variables or credentials (it relies on Membrane for auth). That is proportionate: Urlbox-specific keys are managed server-side by Membrane rather than requested from the user.
Persistence & Privilege
The skill is not always-enabled and is user-invocable; it does not request persistent platform privileges or modify other skills' configurations. Autonomous invocation is allowed by default but is not combined with other concerning factors here.
Assessment
This skill appears to do what it says: it uses the Membrane CLI to connect to Urlbox.io and proxy requests, and it does not request API keys or other local secrets. Before installing or using it: (1) be aware you will need Node/npm (or the ability to run npx) to use the recommended CLI — the registry metadata omits this requirement; (2) installing a global npm package runs code from the npm registry — verify you trust the @membranehq/cli package (check its npm page, GitHub repo, and maintainer reputation) before running 'npm install -g'; (3) using the skill sends requests and (likely) URL data through Membrane's servers — review Membrane's privacy/security policy if you will send sensitive URLs or HTML; (4) if you cannot or do not want to install global packages, you can use the provided npx examples instead; and (5) if you need higher assurance, inspect the Membrane CLI source or run it in an isolated environment. These precautions will reduce risk while allowing the skill to function as intended.Like a lobster shell, security has layers — review code before you run it.
latestvk97ey6rcfeyhd9xmgwy1y2mt59843t55
License
MIT-0
Free to use, modify, and redistribute. No attribution required.