Zoho Workdrive
v1.0.0Zoho WorkDrive integration. Manage data, records, and automate workflows. Use when the user wants to interact with Zoho WorkDrive data.
⭐ 0· 60·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description claim a Zoho WorkDrive integration and all instructions revolve around using the Membrane CLI to connect to Zoho WorkDrive, list actions, run actions, or proxy API requests. Required capabilities (network and a Membrane account) match the stated purpose. Note: the skill source is listed as unknown in the metadata, though the SKILL.md references getmembrane.com and a GitHub repo.
Instruction Scope
SKILL.md only instructs installing and using the Membrane CLI, performing login flows, creating/listing connections, listing/running actions, and proxying requests to Zoho WorkDrive. It does not instruct reading unrelated files, accessing other environment variables, or exfiltrating data to unexpected endpoints. It explicitly advises against asking users for API keys and to let Membrane handle credentials.
Install Mechanism
This is an instruction-only skill with no install spec or code files. It recommends installing @membranehq/cli globally via npm (npm install -g). Global npm installs execute code from the public npm registry, which is a common and reasonable distribution method for CLIs but carries the usual npm supply-chain risks; users should verify the package identity and trustworthiness before installing.
Credentials
The skill declares no required environment variables, no primary credential, and no config paths. The SKILL.md relies on Membrane-managed credentials and browser-based login flows rather than local secrets, which is proportionate to the stated integration purpose.
Persistence & Privilege
The skill does not request always:true and uses normal agent invocation semantics. It does not request to modify other skills or system-wide settings. There is no evidence of it requesting elevated or persistent privileges beyond typical runtime execution.
Assessment
This skill appears coherent: it delegates auth and API plumbing to the Membrane CLI rather than asking for local API keys, and the SKILL.md stays within scope. Before installing, consider: 1) Verify you trust the Membrane project and the @membranehq/cli package (check the publisher, package page, and the referenced GitHub repo). 2) Global npm installs run code on your machine — prefer auditing/installing in an isolated environment or using npx if you don't want a global install. 3) Understand that using this skill routes Zoho WorkDrive requests through Membrane's service (their servers will see request metadata and tokens); review Membrane's privacy/security documentation if handling sensitive files. 4) Because the skill source is listed as unknown in metadata, confirm the homepage/repo ownership matches the publisher you intend to trust. Otherwise, the skill's behavior matches its description.Like a lobster shell, security has layers — review code before you run it.
latestvk977jr4yk9s1ztkrm06mdgagfd84c08c
License
MIT-0
Free to use, modify, and redistribute. No attribution required.