Vtex

VTEX integration. Manage data, records, and automate workflows. Use when the user wants to interact with VTEX data.

This skill appears to do what it says: it uses the Membrane CLI to connect your agent to VTEX. Before installing or using it, confirm you trust the Membrane service (homepage and GitHub repo), because authenticating will grant Membrane access to your VTEX data. You will need npm/node locally to install the CLI—verify that requirement is acceptable. Prefer using the documented connection flow (which keeps API keys server-side) and avoid pasting raw credentials into chat. If you want extra assurance, inspect the @membranehq/cli package source on the referenced GitHub repo and confirm the package name/version matches the SKILL.md instructions.

Type: OpenClaw Skill Name: vtex Version: 1.0.1 The vtex skill bundle provides instructions for an AI agent to manage VTEX e-commerce data using the Membrane CLI. It contains high-risk instructions in SKILL.md, specifically requiring the agent to install a global npm package (@membranehq/cli) and execute actions through a third-party platform (getmembrane.com), including the ability to dynamically create and run new actions (RCE-as-a-service). While these behaviors are aligned with the stated purpose of the skill and the Membrane platform's architecture, they represent significant attack surfaces—global system modification and remote code execution via a third party—without evidence of direct malicious intent.