Workos

WorkOS integration. Manage data, records, and automate workflows. Use when the user wants to interact with WorkOS data.

This skill's instructions appear to do what they claim (use Membrane CLI to work with WorkOS), but the registry metadata fails to declare that the 'membrane' CLI is required and the SKILL.md tells you to install a global npm package and run interactive login flows. Before installing or allowing the agent to run commands: (1) Verify the Membrane CLI package on npm and its GitHub repo (look for publisher, stars, issues, recent commits); (2) prefer using 'npx' or a local install rather than a global -g install if you want to limit system changes; (3) be prepared that 'membrane login' will create tokens/credentials—ask where they are stored and who can access them; (4) restrict autonomous agent actions (require explicit approval) for install/login steps until you confirm the CLI is trustworthy; and (5) if you need higher assurance, request an install spec be added to the skill metadata or ask the maintainer for a signed/source-verified release. If you want, I can list the checks to run on the npm package and GitHub repo.

Type: OpenClaw Skill Name: workos-integration Version: 1.0.1 The skill facilitates WorkOS integration via the Membrane CLI, requiring the agent to perform a global npm installation (`npm install -g @membranehq/cli`) and interact with a third-party service that dynamically generates and executes actions (`membrane action create`). While these behaviors are aligned with the stated purpose of the Membrane platform, they represent high-risk capabilities (third-party remote code execution and global package installation) that increase the attack surface. No evidence of intentional malice or data exfiltration was found in SKILL.md or _meta.json.