Shortcut

Shortcut integration. Manage data, records, and automate workflows. Use when the user wants to interact with Shortcut data.

This skill appears to be a legitimate Shortcut integration that uses the Membrane CLI, but the registry metadata omits the CLI install requirement. Before installing or running it: 1) Verify the @membranehq/cli npm package on the npm registry and inspect its repository (pin a specific version rather than using 'latest'). 2) Avoid installing global npm packages with admin privileges on sensitive systems; consider using a controlled environment (container or VM). 3) Confirm you trust getmembrane.com / the Membrane project and the registry owner. 4) Expect to authenticate via a browser flow — do not share API keys or tokens with the skill. If you need higher assurance, ask the publisher for a reproducible install spec or a signed release URL and for clarity about why the registry metadata doesn't list the required CLI.

Type: OpenClaw Skill Name: shortcut-integration Version: 1.0.3 The skill requires the installation of a global NPM package (@membranehq/cli) and relies on an external service (getmembrane.com) to manage authentication and execute actions. While the instructions in SKILL.md are aligned with the stated purpose of Shortcut integration, the requirement for global binary installation and the use of a third-party CLI to dynamically create and run actions represent a high-risk execution pattern and a significant attack surface.