Spiff

Spiff integration. Manage data, records, and automate workflows. Use when the user wants to interact with Spiff data.

This skill appears internally consistent: it delegates all auth and API work to the Membrane service and instructs you to install/run the official Membrane CLI. Before installing or using it, consider the following: 1) Trust: using the skill means granting Membrane (a third party) access to your Spiff data — review Membrane's privacy/security practices and the @membranehq npm package. 2) Installation: the SKILL.md suggests npm -g install which may require admin permissions; use npx to avoid global installs if you prefer. 3) Autonomy: the agent can invoke the skill autonomously and perform actions through your Membrane connection once you authenticate — limit or monitor agent privileges if you want to avoid automated changes. 4) Verify sources: confirm the CLI package/org and homepage (getmembrane.com and the listed GitHub repo) match your expectations before running install or login commands.

Type: OpenClaw Skill Name: spiff Version: 1.0.1 The skill requires high-risk operations including the global installation of an npm package (@membranehq/cli) and the execution of CLI commands that incorporate JSON-formatted parameters, which poses a risk of shell injection if inputs are not properly sanitized by the agent. Furthermore, the instructions in SKILL.md direct the agent to route all external communications and authentication through a third-party platform (getmembrane.com), which centralizes sensitive access. While these actions are aligned with the stated purpose of Spiff integration, they constitute risky capabilities without explicit malicious intent.