Whitesource
v1.0.0WhiteSource integration. Manage data, records, and automate workflows. Use when the user wants to interact with WhiteSource data.
⭐ 0· 33·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (WhiteSource integration) match the instructions, which exclusively explain how to use the Membrane CLI to connect to and call WhiteSource. The skill does not ask for unrelated credentials or services.
Instruction Scope
SKILL.md directs the agent/user to install and run the Membrane CLI, use membrane login, create connections, list actions, run actions, and proxy arbitrary WhiteSource API requests via Membrane. These instructions are in-scope for a connector. Note: proxying arbitrary endpoints is a powerful feature — it can be used to send any request to the target API, so users should be deliberate about what requests/actions they execute.
Install Mechanism
The skill is instruction-only (no install spec), but instructs installing @membranehq/cli via npm (a public registry package) and uses npx in examples. This is a common approach and not inherently risky, but installing global npm packages modifies the host environment and requires trusting the package maintainers.
Credentials
No environment variables, credentials, or config paths are declared or requested by the skill. SKILL.md explicitly directs users to let Membrane manage credentials rather than entering API keys locally, which is proportionate to the described behavior. Users must, however, trust Membrane's handling of credentials.
Persistence & Privilege
always is false and the skill does not request persistent system-wide privileges or modify other skills. It operates via user-run Membrane CLI commands and browser-based login, which is consistent with the purpose.
Assessment
This skill is coherent but requires trust in the Membrane service and its npm CLI package. Before installing/using it: verify the @membranehq/cli package and the Membrane homepage/repository you trust; be aware that installing a global npm package changes your system environment; only create a Membrane connection for the intended WhiteSource tenant and review available actions before running them (the proxy can send arbitrary API requests); avoid sending unrelated secrets or private data through the proxy; if you need tighter controls, use a dedicated Membrane account/tenant with least privilege and inspect Membrane's documentation and privacy/security policies.Like a lobster shell, security has layers — review code before you run it.
latestvk97cthw255sqpaym0z13qxq80h8463a0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.