Plain

Plain integration. Manage Persons, Organizations, Deals, Leads, Activities, Notes and more. Use when the user wants to interact with Plain data.

This skill is instruction-only and uses the Membrane CLI to talk to Plain. Before installing or running anything: 1) Note the registry metadata did not declare the Membrane CLI as a required binary or include an install spec — the SKILL.md still tells you to run `npm install -g @membranehq/cli@latest`. Ask the publisher to add a proper install declaration. 2) Review the @membranehq/cli npm package and its source (or run it in an isolated environment/container) before installing a global npm package. 3) Confirm you trust getmembrane.com / the Membrane project because authentication is delegated to their service and they will hold connection credentials. 4) Because the skill is instruction-only, there is no packaged code to scan — if you need higher assurance, request a verifiable repository tag or an install spec that pins versions. These steps will reduce the risk from inconsistent metadata and from installing networked tooling.

Type: OpenClaw Skill Name: plain Version: 1.0.3 The skill requires the agent to perform high-privilege operations, specifically the global installation of an external CLI tool (`npm install -g @membranehq/cli`) and delegation of authentication/data handling to a third-party service (getmembrane.com). There is a significant discrepancy in SKILL.md where the metadata describes a CRM/Leads tool while the body describes a document editor, suggesting poor quality or a misleading template. While these patterns are risky and grant broad permissions to an external platform, there is no explicit evidence of intentional malice or data exfiltration.