Thrivecart

Thrivecart integration. Manage data, records, and automate workflows. Use when the user wants to interact with Thrivecart data.

This skill appears to do what it claims: it uses the Membrane service/CLI to interact with Thrivecart. Before installing or running anything: (1) verify the Membrane project and @membranehq/cli package (publisher, GitHub repo, npm page) to ensure you're comfortable installing it; (2) prefer using npx for one-off runs instead of global npm install; (3) be aware that authenticating via Membrane gives that third party access to the connected Thrivecart account — confirm you trust the service and review what data/actions will be permitted; (4) if you need a stricter security posture, request an explicit registry install spec or a vetted binary/source before proceeding.

Type: OpenClaw Skill Name: thrivecart Version: 1.0.3 The skill requires the agent to install a global NPM package (@membranehq/cli) and interact with a third-party service (getmembrane.com) to manage authentication and execute actions. A significant risk is identified in the 'action create' functionality, where the agent is instructed to let a remote service dynamically build and execute logic based on natural language descriptions. While these capabilities are aligned with the stated purpose of the Membrane platform, the requirement for global shell execution and reliance on remotely-orchestrated logic represents a high-privilege attack surface. File: SKILL.md.