Paycaptain

PayCaptain integration. Manage data, records, and automate workflows. Use when the user wants to interact with PayCaptain data.

This skill appears internally consistent: it uses Membrane's CLI to manage PayCaptain data and asks users to authenticate via Membrane rather than providing API keys. Before installing: (1) confirm you trust @membranehq and the getmembrane.com service and review their privacy/data-retention policies, since data and auth are routed through their platform; (2) prefer using npx @membranehq/cli@<pinned-version> or pin a specific CLI version rather than npm install -g @membranehq/cli@latest to reduce supply-chain risk; (3) be prepared for an interactive browser-based login or for the user to copy a headless auth code; and (4) verify the connectorKey (paycaptain) and any action inputs you run so you only grant the minimum needed access. Overall: coherent with its stated purpose.

Type: OpenClaw Skill Name: paycaptain Version: 1.0.3 The paycaptain skill bundle (SKILL.md) instructs the agent to perform high-risk operations including the global installation of a third-party CLI tool (@membranehq/cli) and the execution of dynamic actions via the getmembrane.com platform. These capabilities involve shell execution, network access, and remote action generation, which are considered risky despite being plausibly necessary for the stated PayCaptain integration. No evidence of intentional malice or data exfiltration was found, but the broad system and network permissions required justify a suspicious classification under the provided criteria.