Pendo

Pendo integration. Manage Guides, Segments, Pages, Features, Feedbacks, Polls. Use when the user wants to interact with Pendo data.

This skill appears coherent, but keep these practical points in mind before installing: - The integration relies on the third-party Membrane service and its CLI. Installing the CLI downloads code from npm (global install). Only proceed if you trust @membranehq on npm and are comfortable allowing that CLI to run on your system. - Using the skill routes Pendo auth/requests through Membrane. That means Membrane will have access to whatever Pendo data you connect; review Membrane's privacy/security docs and your org's policy before granting access. - The SKILL.md recommends not asking the user for API keys — a good practice. Still, be aware that connecting will require authenticating via Membrane (browser-based flow or manual code). - If you need to limit risk, run the CLI in a controlled environment or review the @membranehq/cli package contents/version on npm/GitHub before installing. - If you need higher assurance, ask the publisher for a code-backed skill (so the code can be inspected) or for more details on how Membrane stores and scopes Pendo credentials.

Type: OpenClaw Skill Name: pendo Version: 1.0.3 The skill provides instructions for the agent to install and use the Membrane CLI to interact with Pendo. While the behavior is aligned with the stated purpose, it requires high-risk capabilities including global software installation (`npm install -g @membranehq/cli@latest`) and shell/network access to execute commands and manage external data. Per the analysis criteria, these risky capabilities (shell/network access), although plausibly needed for the stated purpose in SKILL.md, warrant a suspicious classification. No clear evidence of intentional malice was found.