Zuora Billing
v1.0.0Zuora Billing integration. Manage data, records, and automate workflows. Use when the user wants to interact with Zuora Billing data.
⭐ 0· 50·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Zuora Billing integration) matches the instructions: all actions are performed via the Membrane CLI and proxying to the Zuora API. Required network access and a Membrane account are reasonable for this purpose.
Instruction Scope
SKILL.md contains step-by-step CLI usage (installing membrane, logging in, creating connections, listing/running actions, and proxying requests). It does not instruct reading unrelated local files, environment variables, or sending data to unexpected endpoints beyond Membrane/Zuora. Proxying requests through Membrane (which will see request/response data) is explicitly documented and coherent with the stated goal.
Install Mechanism
The skill is instruction-only (no automatic install spec), but directs users to install a third-party npm CLI package (npm install -g @membranehq/cli) and to use npx in examples. Installing global npm packages and running npx are common but carry supply-chain risk; the skill does not attempt to download arbitrary archives or run unknown scripts automatically.
Credentials
No environment variables, secrets, or config paths are requested by the skill. The documentation explicitly advises against asking users for API keys and relies on Membrane to manage credentials server-side—this is proportionate to the purpose.
Persistence & Privilege
The skill does not request always-on inclusion or system-wide changes. It's user-invocable and does not declare elevated persistence or modify other skills/configs.
Assessment
What to consider before installing: 1) The skill delegates auth and proxied requests to Membrane — that means Membrane's service will see your Zuora data and hold credentials; confirm you trust Membrane and review their privacy/security docs. 2) The SKILL.md tells you to install @membranehq/cli via npm (global install) and examples use npx; vet the npm package (check its official repo, release history, maintainers) and prefer ephemeral uses (npx or containerized environments) in sensitive systems to reduce supply-chain risks. 3) Review the permissions requested by any Membrane connection you create in your organization (least-privilege for API scopes). 4) Since this is instruction-only, nothing will be installed automatically by the registry, but following the guide will add a third-party CLI to your environment — proceed only if you accept that trust and supply-chain tradeoff.Like a lobster shell, security has layers — review code before you run it.
latestvk971wwxsr5x4vryygszysqs38x84cjrg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.