Formcan
v1.0.2FormCan integration. Manage Forms, Users, Roles. Use when the user wants to interact with FormCan data.
⭐ 0· 98·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (FormCan integration) matches the instructions: all actions go through the Membrane CLI to call FormCan APIs. No unrelated credentials, binaries, or config paths are requested.
Instruction Scope
SKILL.md directs the agent to install and use the Membrane CLI, perform login, create/list connections, run actions, or proxy requests to FormCan. It does not instruct reading unrelated files or exfiltrating environment variables. It does rely on network access and a Membrane account, which is stated.
Install Mechanism
No formal install spec is present in the registry entry (instruction-only), but the README recommends installing @membranehq/cli via npm (-g). Installing a public npm CLI is a common, moderate-risk operation; users should verify the package name/owner on npm before installing.
Credentials
The skill requests no environment variables or credentials itself. It relies on Membrane to manage FormCan credentials (browser login/connector). That is proportionate, but it means the Membrane service/CLI will have access to FormCan auth tokens on your behalf.
Persistence & Privilege
always is false and there is no installer that makes the skill permanent. disable-model-invocation is false (normal). The skill does not request elevated system presence or modify other skills.
Assessment
This skill is instruction-only and uses the Membrane CLI as a proxy to call FormCan. Before installing or using it: (1) verify the npm package @membranehq/cli and its publisher on the npm registry; (2) understand that Membrane (the CLI/service) will hold and use your FormCan credentials and can proxy arbitrary API requests—only grant the connector the permissions you intend; (3) run the install commands yourself in a trusted environment (global npm installs change your PATH); (4) if you do not want the agent to authenticate or act autonomously with your FormCan data, avoid enabling autonomous invocation for this skill or limit when it can run. If you want additional assurance, ask the skill author for a signed package URL or a public repository commit hash to verify the CLI code.Like a lobster shell, security has layers — review code before you run it.
latestvk97b0fpm3d3tpz1hbqyp982w11843dwd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.