NetPad - Build forms, workflows and manage MongoDB data
v1.0.0Manage NetPad forms, submissions, users, and RBAC. Use when: (1) Creating forms with custom fields, (2) Submitting data to forms, (3) Querying form submissions, (4) Managing users/groups/roles (RBAC), (5) Installing NetPad apps from marketplace. Requires NETPAD_API_KEY for API, or `netpad login` for CLI.
⭐ 3· 1.7k·0 current·0 all-time
byMichael Lynn@mrlynn
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name, description, CLI wrapper, and API docs align: the skill manages forms, submissions, RBAC and installs a netpad CLI via the @netpad/cli npm package. Required binaries (curl, jq, netpad) are appropriate for the stated purpose. However, the registry metadata lists no required environment variables while both SKILL.md and scripts/netpad.sh require NETPAD_API_KEY — an incoherence between declaration and actual needs.
Instruction Scope
SKILL.md and the shell wrapper limit actions to calling NetPad REST endpoints or the netpad CLI and printing results. They instruct using a Bearer API key and provide example curl calls; there are no instructions to read unrelated local files or send data to third-party endpoints outside netpad.io. The wrapper does include an 'export NETPAD_API_KEY' example and uses NETPAD_BASE_URL override (which is reasonable).
Install Mechanism
Install uses the npm package @netpad/cli to create the netpad binary. This is a standard distribution method for a CLI and is proportionate to the functionality. No arbitrary downloads or extract-from-unknown-URLs are present in the spec.
Credentials
The runtime clearly requires an API key (NETPAD_API_KEY) to call the service, but the registry metadata provided to the platform does not list any required environment variables or a primary credential. That mismatch is concerning because a user or automated installer may not be warned that they need to supply a secret. The wrapper also allows NETPAD_BASE_URL override (acceptable) but the skill does not declare these in its manifest.
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. It installs a CLI binary via npm (normal) and contains no code that attempts to modify other skills or system-wide agent settings. Autonomous invocation is enabled by default but not combined with other high-risk factors here.
What to consider before installing
Key things to consider before installing: (1) The skill requires an API key (NETPAD_API_KEY) even though the manifest omitted it — do not provide production credentials until you confirm trust. Use a test key if available. (2) Inspect the npm package @netpad/cli source (or its npm page and publisher) to ensure it’s legitimate and hasn’t been tampered with. (3) The included shell wrapper has coding bugs (e.g., add-field uses undefined variable names) — this suggests limited maintenance; test functionality in an isolated environment first. (4) Check where the netpad CLI stores credentials (local files, OS keychain) and whether it persists tokens; avoid giving long-lived production credentials until you’re comfortable. (5) If you need higher confidence, ask the publisher for source repo/homepage or a checksum for the npm package; presence of a well-known org website or GitHub repo would raise confidence.Like a lobster shell, security has layers — review code before you run it.
latestvk97f86rx6anny2pjhf2m7bs40d809teb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📋 Clawdis
Binscurl, jq, netpad
Install
Install NetPad CLI (npm)
Bins: netpad
npm i -g @netpad/cli