Smarty

Smarty integration. Manage Organizations, Pipelines, Users, Goals, Filters. Use when the user wants to interact with Smarty data.

This skill's runtime instructions (use the Membrane CLI) look normal, but the metadata and SKILL.md contradict each other about what 'Smarty' refers to. Before installing: 1) Confirm with the publisher which 'Smarty' this skill integrates with (PHP template engine vs. address/data connector). 2) Verify the publisher and repository (the SKILL.md points to Membrane; check that @membranehq on npm and the repository are legitimate). 3) Prefer testing the npm CLI in a sandbox or container rather than doing a global npm install on a production machine. 4) Be aware the workflow uses browser-based auth and Membrane servers (network access) which will grant the Membrane service access to the connected external accounts; verify privacy/permissions for those connections. The static scanner had no code to analyze (instruction-only), so absence of findings does not guarantee safety.

Type: OpenClaw Skill Name: smarty Version: 1.0.3 The skill bundle exhibits high-risk behavior by instructing the agent to perform global system modifications (npm install -g) and execute shell commands for authentication and remote action execution. The documentation in SKILL.md is highly inconsistent and misleading, conflating the Smarty PHP template engine with Smarty (formerly SmartyStreets) address verification services and CRM-like features (Pipelines/Goals). While these commands are part of the legitimate Membrane platform (getmembrane.com) workflow, the requirement for global NPM installs and the confusing instructions pose a security risk and suggest poor quality control or automated generation without verification.