Zoho Analytics
v1.0.0Zoho Analytics integration. Manage data, records, and automate workflows. Use when the user wants to interact with Zoho Analytics data.
⭐ 0· 18·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The README/skill claims to integrate with Zoho Analytics and all runtime instructions use the Membrane CLI and Membrane's proxy to talk to Zoho. Asking the user to create a Membrane connection and use membrane action/request commands is coherent with the stated purpose. Minor metadata mismatch: the registry lists no required binaries, but the SKILL.md instructs installing the @membranehq/cli (npm) — this should have been declared in metadata but does not change the overall purpose alignment.
Instruction Scope
The SKILL.md stays within the integration scope: it instructs installing and using the Membrane CLI, creating connections, listing actions, running actions, and proxying requests to Zoho. It does not instruct reading unrelated local files or env vars. Important operational detail: Membrane handles authentication server-side and the user must authenticate via a browser (or headless flow), which hands Zoho credentials/tokens to Membrane; the skill relies on that third-party service for auth and request proxying.
Install Mechanism
There is no install spec in the registry, but SKILL.md asks users to run `npm install -g @membranehq/cli` (and uses npx in examples). Installing a global npm package is a common but privileged install operation (runs package lifecycle scripts). This is a moderate-risk install vector compared with instruction-only skills that require no installs; however, the package appears to be an official Membrane CLI (npm ecosystem and GitHub repo referenced).
Credentials
The skill declares no required environment variables, which matches the absence of local secret requirements. However, it does require a Membrane account and browser-based authentication that results in Membrane holding and refreshing Zoho credentials and proxying requests. This is proportional to the integration goal but does require trusting Membrane with account access — a non-trivial trust decision for users/organizations.
Persistence & Privilege
The skill is not set to always:true and has default autonomous invocation settings. That is normal. Be aware: if the agent is allowed to invoke the skill autonomously and a valid Membrane connection exists, the agent could run Membrane actions that modify Zoho data (reads, writes, deletes) via the proxy. This is expected given the integration purpose but is a risk consideration for sensitive accounts.
Assessment
This skill appears to do what it says — it delegates Zoho access to the Membrane service and shows how to use the @membranehq/cli. Before installing or using it: (1) Verify you trust Membrane (getmembrane.com / the referenced GitHub repo) because the service will hold Zoho tokens and proxy API calls; (2) prefer creating a least-privilege Zoho account or limited-scope connector for this integration; (3) be cautious installing global npm packages (they run install scripts) — consider using npx or installing in a controlled environment; (4) if you allow the agent to invoke skills autonomously, restrict or audit what actions it can run (it could otherwise modify or delete data in Zoho); and (5) ask the publisher to update the registry metadata to declare the Membrane CLI as a required binary/install step for clearer auditing.Like a lobster shell, security has layers — review code before you run it.
latestvk97fj00qakchbgmvd858mw89x58472zv
License
MIT-0
Free to use, modify, and redistribute. No attribution required.