Yardstik

Yardstik integration. Manage data, records, and automate workflows. Use when the user wants to interact with Yardstik data.

This skill appears internally consistent: it uses the Membrane CLI to connect to Yardstik and does not request unrelated secrets. Before proceeding: (1) verify the @membranehq/cli package on npm (publisher, recent releases, and popularity) before running a global npm install; prefer using `npx` to avoid a global install. (2) Be aware the login flow opens a browser or prints an auth URL — only complete that flow if you trust Membrane to manage access to your Yardstik account. (3) Confirm what permissions the created connection will have in Yardstik (read vs. write) and avoid granting broader access than needed. If you want a deeper review, provide the Membrane CLI package link or the exact permission scope requested by the connector so I can check for any mismatches.

Type: OpenClaw Skill Name: yardstik Version: 1.0.1 The skill instructions in SKILL.md direct the AI agent to perform high-risk operations, including global package installation ('npm install -g @membranehq/cli@latest'), system-level shell command execution, and network communication with external endpoints (getmembrane.com). While these actions are aligned with the stated purpose of integrating Yardstik via the Membrane platform, the reliance on an external CLI and the ability to dynamically create and run actions ('membrane action create/run') constitute risky capabilities that meet the threshold for a suspicious classification under the provided criteria.