Referralhero

ReferralHero integration. Manage data, records, and automate workflows. Use when the user wants to interact with ReferralHero data.

This skill appears internally consistent and is likely safe for use if you trust Membrane. Before installing: verify the @membranehq/cli package (publisher, npm page, and GitHub repo), consider installing a pinned version rather than `@latest`, and review the permissions the Membrane connection will have to your ReferralHero account. Because the flow uses browser-based login and server-side credential handling, do not share API keys locally — follow the advertised connection flow. If you need higher assurance, request the CLI package checksum or use an isolated environment to install and test it first.

Type: OpenClaw Skill Name: referralhero Version: 1.0.3 The skill facilitates integration with ReferralHero via the Membrane CLI, requiring high-risk operations such as global package installation (`npm install -g @membranehq/cli`) and shell command execution for authentication and action management. While the instructions in SKILL.md are aligned with the stated purpose and promote secure practices like avoiding local secret storage, the requirement for shell and network access to perform arbitrary actions via a third-party platform meets the threshold for a 'suspicious' classification under the provided criteria. No evidence of intentional malice, such as data exfiltration or backdoors, was identified.