Google Forms
v1.0.2Google Forms integration. Manage data, records, and automate workflows. Use when the user wants to interact with Google Forms data.
⭐ 0· 87·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The SKILL.md consistently describes a Google Forms integration implemented via the Membrane CLI and a Membrane account. That is coherent with the skill's stated purpose. However, the registry metadata declares no required binaries or credentials while the instructions clearly require the 'membrane' CLI and a Membrane account/connection — an inconsistency in declared requirements.
Instruction Scope
The instructions stay within the stated purpose: install/use the Membrane CLI, create a connector, list/run actions, and proxy requests to the Google Forms API. The instructions do not ask the agent to read unrelated local files or environment variables, nor to exfiltrate data to unexpected endpoints. They do include headless/browser auth flows and the ability to proxy arbitrary API paths (expected for this kind of integration).
Install Mechanism
The skill is instruction-only (no install spec in the registry), but SKILL.md directs the user to install a global npm package (npm install -g @membranehq/cli) and suggests npx usage. Installing a global npm CLI is a normal but non-trivial action (it writes to disk and runs third-party code from the npm registry). The registry did not provide an automated install spec; that mismatch is informational but not inherently malicious.
Credentials
The registry lists no required environment variables or credentials, and SKILL.md explicitly says Membrane handles auth server-side and you should not ask users for API keys. That is proportionate. One important privacy/security consideration: using Membrane means requests and data pass through Membrane's service (including auth tokens and proxied request bodies), so trusting Membrane's handling of data and scopes is required.
Persistence & Privilege
The skill does not request always:true or any persistent system-level privileges. It's instruction-only and has no code that would be installed by the registry. Autonomous invocation is allowed (platform default) but not paired with other red flags.
Assessment
This skill appears to do what it says: it uses the Membrane CLI to work with Google Forms. Before installing or using it: (1) confirm you are comfortable installing a global npm package (@membranehq/cli) and that your environment allows that; (2) review Membrane's privacy, terms, and the OAuth scopes the Google Forms connector requests (Membrane will proxy requests and will see the data and tokens); (3) note the registry metadata omitted the runtime requirement for the 'membrane' binary and a Membrane account — expect to perform browser-based login; and (4) if you need tighter control, verify the connector's scopes and consider creating a principle/account with minimum privileges for the connector. If any of these are unacceptable, do not install or use the skill.Like a lobster shell, security has layers — review code before you run it.
latestvk971zs3v53g0saewn6sts32ckn8423a3
License
MIT-0
Free to use, modify, and redistribute. No attribution required.