Zoho Expense
v1.0.0Zoho Expense integration. Manage data, records, and automate workflows. Use when the user wants to interact with Zoho Expense data.
⭐ 0· 61·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The SKILL.md describes a Zoho Expense integration that uses the Membrane CLI to handle auth and proxy requests — this matches the skill name/description. However, the registry metadata claims no required binaries or environment variables while the instructions explicitly require the @membranehq/cli and a Membrane account (network access). That mismatch is an inconsistency in metadata (not necessarily malicious) and should be corrected/verified before trusting automated installs.
Instruction Scope
The runtime instructions stay on-topic: install the Membrane CLI, log in, create a connection, list and run actions, or proxy direct API requests through Membrane. The doc explicitly instructs not to ask users for API keys and does not tell the agent to read unrelated files or secrets. No broad or hidden data‑collection steps are present in SKILL.md.
Install Mechanism
There is no formal install spec in the registry; instead the SKILL.md tells users to run `npm install -g @membranehq/cli` (or use npx in examples). Installing a third‑party npm package globally is common and reasonable here but carries typical npm risks (install scripts, arbitrary code execution during install). This is a moderate risk only if you install without review — the skill does not automatically download code itself.
Credentials
The skill requests no environment variables or local credentials and tells integrators to rely on Membrane for auth/refresh, which is proportionate. One important implication: using this skill means your Zoho data and credentials will be handled by Membrane's service (server-side), so you should verify Membrane's privacy/security model before delegating access.
Persistence & Privilege
The skill does not request elevated platform privileges. Flags show always:false and normal autonomous invocation is allowed (default). There is no instruction to modify other skills or system-wide config.
Assessment
This skill appears to do what it says: it expects you to use the Membrane CLI to connect to Zoho Expense. Before installing or using it, verify the @membranehq/cli npm package and the Membrane service (review the package on npm and its GitHub repo, confirm the publisher, and read Membrane's privacy/security docs). Prefer using npx or a container/virtualenv instead of a global npm install if you want to limit system impact. Remember that Membrane will proxy requests and manage credentials server-side — if you are not comfortable with a third party handling Zoho credentials and data, do not create the connection. Finally, correct the registry metadata mismatch (the skill should declare that the Membrane CLI and network/Membrane account are required) before trusting automated tooling to install or invoke this skill.Like a lobster shell, security has layers — review code before you run it.
latestvk972qrbkpaczqvke3cb6qrf4ts84bnd4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.