Niftykit

NiftyKit integration. Manage Organizations, Users. Use when the user wants to interact with NiftyKit data.

This skill is coherent and appears to do what it says: it uses the Membrane CLI to connect to NiftyKit and does not request extra credentials. Before installing/using it: (1) verify the @membranehq/cli package and its repository (npm/github) to confirm you trust the publisher; (2) review the OAuth/connection permissions when you authenticate in the browser (the connection grants Membrane access to your NiftyKit account); (3) avoid installing global npm packages on sensitive, production, or high-privilege hosts without auditing them; and (4) remember autonomous agent invocation is allowed by default — if you do not want the agent to call this skill without prompting, disable model invocation for the skill in your agent settings.

Type: OpenClaw Skill Name: niftykit Version: 1.0.2 The skill instructions in SKILL.md direct the agent to perform high-risk operations, including the global installation of an NPM package (@membranehq/cli) and the execution of shell commands to interact with the NiftyKit API. Specifically, it encourages the agent to construct shell commands with JSON payloads (e.g., using the --input flag), which introduces a significant risk of shell injection if user-provided data is not properly sanitized. While these capabilities are plausibly needed for the stated purpose of service integration, they represent risky behaviors and potential vulnerabilities as defined in the analysis criteria.