Shiphero
v1.0.1ShipHero integration. Manage data, records, and automate workflows. Use when the user wants to interact with ShipHero data.
⭐ 0· 57·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (ShipHero integration) match the SKILL.md: all runtime steps are about installing and using the Membrane CLI to connect to ShipHero, list actions, run actions, or proxy raw requests. No unrelated credentials, binaries, or config paths are requested.
Instruction Scope
Instructions stay within the stated purpose (installing membrane CLI, logging in, creating/using a ShipHero connection, running actions, or proxying requests). They do not instruct reading arbitrary local files or environment variables. Important to note: the skill relies on Membrane to hold credentials and proxy API traffic, so using it means the Membrane service will see proxied requests and hold auth tokens.
Install Mechanism
There is no registry install spec, but SKILL.md tells users to run 'npm install -g @membranehq/cli' (and suggests npx usage). Installing a global npm CLI is a common approach but carries moderate risk: it writes to the system and executes third‑party code from the npm registry. Verify the package and prefer npx or scoped/local installs if you want lower footprint.
Credentials
The skill does not request environment variables, local config paths, or secrets. However, it requires a Membrane account and browser‑based login; credentials and tokens are managed server‑side by Membrane. This is proportionate to the skill's design but implies trusting a third party with API credentials and proxied request content.
Persistence & Privilege
The skill is not force-included (always: false) and does not request elevated platform privileges. The only persistent change the instructions suggest is installing a CLI tool locally (npm global install), which is normal for CLI-based integrations.
Assessment
This skill appears internally consistent: it asks you to install and use the Membrane CLI to connect and proxy ShipHero calls. Before installing, consider the following: 1) You must trust Membrane (getmembrane.com) because it will store tokens and proxy API requests — review their privacy/security docs and terms. 2) Instead of 'npm install -g', prefer 'npx @membranehq/cli' or a local install to avoid global system changes. 3) Verify the npm package maintainer and package integrity (package name, publisher, and recent activity) to reduce supply‑chain risk. 4) If you cannot or do not want a third party to hold your ShipHero credentials or see request payloads, consider connecting directly to ShipHero via its official methods instead. If you want more assurance, provide the package tarball URL, Membrane's privacy/security documentation, or the connector implementation so I can re-evaluate with that information.Like a lobster shell, security has layers — review code before you run it.
latestvk979pat16ntqsq4jtp6z44f33d84cz27
License
MIT-0
Free to use, modify, and redistribute. No attribution required.