Namely

Namely integration. Manage Persons, Organizations, Jobs, Goals, Payrolls. Use when the user wants to interact with Namely data.

This skill appears to be a legitimate Namely integration that uses the Membrane CLI to handle authentication and API calls, but the registry metadata omits that dependency. Before installing or running anything: 1) Verify you intend to use the @membranehq/cli npm package and inspect that package on npm/GitHub for authenticity; 2) Understand that you must create a Membrane account and that Membrane will hold and refresh Namely credentials and proxy requests — this grants Membrane access to sensitive HR data, so confirm organizational policies and trust the vendor; 3) Expect to run browser-based login flows or copy codes in headless environments; 4) Prefer granting least privilege on the Namely side and coordinate with HR/IT; and 5) If you want the registry metadata to be correct, ask the publisher to declare the membrane CLI as a required binary and to note the need for a Membrane account so automated tooling and reviewers can see the dependency up front.

Type: OpenClaw Skill Name: namely Version: 1.0.2 The skill provides instructions for managing Namely HRIS data using the Membrane CLI, which involves high-risk operations such as global npm installation (@membranehq/cli), shell command execution, and network access. While these capabilities are aligned with the stated purpose of the integration, the pattern of constructing shell commands with JSON input strings in SKILL.md presents a potential shell injection surface. Per the provided criteria, the presence of these risky capabilities—even when plausibly needed—warrants a suspicious classification.