Nifty

Nifty integration. Manage Organizations. Use when the user wants to interact with Nifty data.

This skill appears coherent and uses the Membrane CLI to talk to Nifty. Before installing or running anything: (1) verify the Membrane CLI package and repository (npmjs and GitHub) to ensure you trust the publisher; (2) prefer npx or an ephemeral install if you want to avoid a global npm install, because npm packages can run install-time scripts; (3) be aware the CLI will open a browser or provide an auth code and will store credentials locally—review where credentials are stored if that matters for your environment; (4) do not paste API keys or secrets into chat; follow the documented 'connect' flow so Membrane manages auth server-side as intended. If you need higher assurance, test in an isolated environment first.

Type: OpenClaw Skill Name: nifty Version: 1.0.3 The skill requires the installation of a global NPM package (@membranehq/cli) and directs the agent to route all authentication and API interactions through a third-party platform (Membrane). While aligned with the stated purpose of Nifty integration, the instructions to perform global system installations and the use of 'membrane action create'—which generates and executes logic from a remote service—represent a high-risk operational pattern for an automated agent. These behaviors are classified as suspicious due to the significant attack surface and dependency on external infrastructure (getmembrane.com) for core logic execution.