Signable

Signable integration. Manage Documents, Templates, Users, Teams. Use when the user wants to interact with Signable data.

This skill appears to do what it says: it uses the Membrane CLI to talk to Signable. Before installing or using it, consider: (1) Review the @membranehq/cli package and its repository (supply-chain risk with npm packages); prefer using npx or an isolated environment instead of npm -g. (2) Understand that signing in hands Signable access tokens to Membrane — only proceed if you trust Membrane and/or use an account with limited permissions. (3) Avoid running global installs on sensitive machines; run commands in a container or VM if you want to isolate risk. (4) Verify the Membrane privacy/security documentation (and the connector configuration) if you need to ensure tokens aren’t retained or used beyond expected scope. Overall the skill is internally consistent, but trust in the third-party Membrane service and the npm package is the primary remaining consideration.

Type: OpenClaw Skill Name: signable Version: 1.0.3 The skill provides instructions for the agent to install a global npm package (@membranehq/cli) and use the Membrane platform to interact with Signable. It involves high-risk capabilities such as global software installation, remote authentication flows, and the dynamic creation and execution of remote 'actions' (RCE-as-a-service). While these behaviors are aligned with the stated purpose of the integration, the reliance on external CLI installation and remote code execution constitutes a significant attack surface and meets the criteria for a suspicious classification (SKILL.md).