← Back to Skills Marketplace
Poof
by
Membrane Dev
· GitHub ↗
· v1.0.3
· MIT-0
149
Downloads
0
Stars
0
Active Installs
4
Versions
Install in OpenClaw
/install poof
Description
Poof integration. Manage Persons, Organizations, Deals, Leads, Projects, Activities and more. Use when the user wants to interact with Poof data.
Usage Guidance
This skill appears to be an instruction-only Membrane CLI integration, which is plausible, but there are red flags to check before proceeding:
- Confirm the intended target: the registry description (CRM-like objects) and the SKILL.md description (disappearing-messaging app) do not match. Ask the publisher which 'Poof' this integrates with.
- The SKILL.md tells you to install @membranehq/cli globally via npm even though the registry metadata lists no required binaries. Prefer using 'npx' if you want to avoid a global install, and verify the npm package and publisher (@membranehq) are legitimate.
- The CLI uses browser-based auth and creates connections; review what permissions the Membrane connection will grant and where tokens/connection metadata are stored (Membrane claims to manage credentials server-side). If you have sensitive data, verify Membrane's privacy/hosting model and access controls.
- Because the skill is instruction-only, it cannot be inspected for hidden code beyond the text. If you need higher assurance, request a skill version that includes a manifested install spec and a signed source repository, or ask the publisher to clarify the purpose mismatch and provide official API docs for the target service.
Given these inconsistencies, treat the skill as untrusted until the publisher clarifies the purpose and confirms the CLI package/source.
Capability Analysis
Type: OpenClaw Skill
Name: poof
Version: 1.0.3
The SKILL.md file contains highly inconsistent and incoherent instructions, describing CRM-like features (Deals, Leads) in the metadata while claiming the app is a 'disappearing message app' in the body. It also includes a raw LLM refusal/hallucination ('I am sorry, I cannot provide an API...') within the documentation. Critically, it instructs the agent to perform a global system modification via 'npm install -g @membranehq/cli@latest', which is a high-privilege operation. While the Membrane platform itself may be legitimate, the poor construction and the requirement for global software installation for an ill-defined service present a significant security risk.
Capability Assessment
Purpose & Capability
The registry description (manage Persons, Organizations, Deals, Leads, Projects, Activities) reads like a CRM integration, but the SKILL.md describes 'Poof' as a disappearing-message app. This mismatch between claimed purpose and the runtime instructions is unexplained and suspicious.
Instruction Scope
All runtime instructions direct the agent to use the Membrane CLI to discover/connect/run actions, which is coherent for a Membrane-backed connector. The SKILL.md also instructs installing and running CLI commands that will open browser-based auth and create connections. Instructions avoid asking for raw API keys (they explicitly say 'let Membrane handle credentials'), which is appropriate. However, the SKILL.md contains procedural install/auth steps even though the skill metadata declares no required binaries—an inconsistency.
Install Mechanism
There is no formal install spec in the registry metadata, but SKILL.md recommends installing the Membrane CLI globally via 'npm install -g @membranehq/cli@latest' (and provides npx alternatives). Because the skill is instruction-only, this will install software if the operator follows instructions. The install source (npm @membranehq/cli) is a public registry package (moderate risk) and is expected for a Membrane integration, but the lack of an explicit install declaration in metadata is an inconsistency worth flagging.
Credentials
The skill declares no required environment variables or credentials and the SKILL.md explicitly instructs to avoid asking for API keys by letting Membrane manage auth. The CLI-based browser flow is appropriate for third-party access and there are no requests for unrelated secrets in the text.
Persistence & Privilege
always is false and there is no instruction to modify other skills or global agent config. The skill relies on user-driven CLI auth flows; it does not request permanent elevated privileges in the provided instructions.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install poof - After installation, invoke the skill by name or use
/poof - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.3
Auto sync from membranedev/application-skills
v1.0.2
Revert refresh marker
v1.0.1
Refresh update marker
v1.0.0
Auto sync from membranedev/application-skills
Metadata
Frequently Asked Questions
What is Poof?
Poof integration. Manage Persons, Organizations, Deals, Leads, Projects, Activities and more. Use when the user wants to interact with Poof data. It is an AI Agent Skill for Claude Code / OpenClaw, with 149 downloads so far.
How do I install Poof?
Run "/install poof" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Poof free?
Yes, Poof is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Poof support?
Poof is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Poof?
It is built and maintained by Membrane Dev (@membranedev); the current version is v1.0.3.
More Skills