Poof

Poof integration. Manage Persons, Organizations, Deals, Leads, Projects, Activities and more. Use when the user wants to interact with Poof data.

This skill appears to be an instruction-only Membrane CLI integration, which is plausible, but there are red flags to check before proceeding: - Confirm the intended target: the registry description (CRM-like objects) and the SKILL.md description (disappearing-messaging app) do not match. Ask the publisher which 'Poof' this integrates with. - The SKILL.md tells you to install @membranehq/cli globally via npm even though the registry metadata lists no required binaries. Prefer using 'npx' if you want to avoid a global install, and verify the npm package and publisher (@membranehq) are legitimate. - The CLI uses browser-based auth and creates connections; review what permissions the Membrane connection will grant and where tokens/connection metadata are stored (Membrane claims to manage credentials server-side). If you have sensitive data, verify Membrane's privacy/hosting model and access controls. - Because the skill is instruction-only, it cannot be inspected for hidden code beyond the text. If you need higher assurance, request a skill version that includes a manifested install spec and a signed source repository, or ask the publisher to clarify the purpose mismatch and provide official API docs for the target service. Given these inconsistencies, treat the skill as untrusted until the publisher clarifies the purpose and confirms the CLI package/source.

Type: OpenClaw Skill Name: poof Version: 1.0.3 The SKILL.md file contains highly inconsistent and incoherent instructions, describing CRM-like features (Deals, Leads) in the metadata while claiming the app is a 'disappearing message app' in the body. It also includes a raw LLM refusal/hallucination ('I am sorry, I cannot provide an API...') within the documentation. Critically, it instructs the agent to perform a global system modification via 'npm install -g @membranehq/cli@latest', which is a high-privilege operation. While the Membrane platform itself may be legitimate, the poor construction and the requirement for global software installation for an ill-defined service present a significant security risk.