Token Metrics
v1.0.0Token Metrics integration. Manage data, records, and automate workflows. Use when the user wants to interact with Token Metrics data.
⭐ 0· 46·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description (Token Metrics integration) match the instructions which rely on the Membrane CLI to proxy requests to Token Metrics. Minor metadata omission: registry metadata lists no required binaries but the runtime instructions explicitly tell the user to install the Membrane CLI (npm package). This is coherent with the stated purpose, though the metadata could have declared the CLI as a required binary.
Instruction Scope
SKILL.md confines runtime behavior to installing/using the Membrane CLI, creating/using connections, running actions, and optionally proxying API calls through Membrane. It does not instruct reading unrelated files, pulling arbitrary URLs, or asking the user for unrelated credentials.
Install Mechanism
There is no formal install spec; the skill instructs the user to install @membranehq/cli from npm (or use npx). Installing a global npm package is a standard mechanism but has moderate risk compared with an instruction-only skill that installs nothing. The package source (npm @membranehq/cli) and Membrane homepage are provided; there are no suspicious download URLs.
Credentials
The skill declares no required environment variables or credentials and instructs users to authenticate via Membrane's connection flow (browser-based OAuth-like flow). That is proportional: Membrane will hold/refresh credentials rather than asking for API keys locally.
Persistence & Privilege
always:false and no install-time persistence is requested. The skill does not ask to modify other skills or system-wide settings. The agent may invoke the skill autonomously (default), which is typical for skills and acceptable here given the narrow scope.
Assessment
This skill is instruction-only and asks you to use the Membrane CLI to connect to Token Metrics. Before installing or authenticating: 1) Verify you trust Membrane (@membranehq) and review its npm package and privacy/permissions (getmembrane.com and the referenced GitHub) because Membrane will hold and refresh your Token Metrics credentials and can proxy requests on your behalf. 2) Installing a global npm package is standard but introduces a third-party binary on your system — prefer using npx if you want to avoid a global install. 3) Be aware that any actions you run through the connection will be executed by Membrane on your behalf, so avoid granting broader scopes than necessary. If you want more assurance, ask the skill author/maintainer for package integrity information (package URL, maintainer identity, and the exact permissions/scopes requested during connection).Like a lobster shell, security has layers — review code before you run it.
latestvk979y74qft75686f5a52b5hyfs84cj9r
License
MIT-0
Free to use, modify, and redistribute. No attribution required.