by 下载技能包
最后更新
2026/4/22
安全扫描
OpenClaw
安全
high confidenceThe skill's instructions, requirements, and actions are coherent: it integrates Holded by driving the Membrane CLI and does not request unrelated credentials or unexplained system access.
评估建议
This skill appears to be what it claims: an instruction set for using the Membrane CLI to interact with Holded. Before installing/using: (1) confirm you trust Membrane/@membranehq and the npm package (review the package source on GitHub and pin a trusted version rather than using @latest), (2) understand that authentication and API calls will be brokered through Membrane (your Holded data and tokens are handled server-side by their service), and (3) avoid running global installs or CLI commands ...详细分析 ▾
✓ 用途与能力
Name/description match the requested capabilities: the skill is an instruction-only integration for Holded that relies on the Membrane CLI. It does not ask for unrelated environment variables, binaries, or config paths.
ℹ 指令范围
SKILL.md stays within the integration scope (install Membrane CLI, login, create a connection, list and run actions). It requires network access and sends requests via Membrane (the doc repeatedly instructs using Membrane to handle auth), so using it will transmit Holded-related data/requests to Membrane servers — expected for a brokered integration but worth noting for privacy compliance.
ℹ 安装机制
There is no built-in install spec for the skill itself, but the instructions ask the user to npm install -g @membranehq/cli@latest. Installing a global npm package is a reasonable way to get the CLI but is a moderate-risk action (executable code from the npm registry). The skill does not instruct downloads from unknown hosts or use URL shorteners.
✓ 凭证需求
The skill declares no required env vars or credentials and explicitly advises not to ask users for API keys; authentication is delegated to Membrane. This is proportionate, though it means credentials and API calls are handled server-side by Membrane.
✓ 持久化与权限
The skill is not configured as always:true, does not request system-wide configuration changes, and is user-invocable. It does not ask to modify other skills or store credentials beyond the Membrane-managed connection.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/4/22
Auto sync from membranedev/application-skills
● Pending
安装命令
点击复制官方npx clawhub@latest install holded-integration
镜像加速npx clawhub@latest install holded-integration --registry https://cn.longxiaskill.com镜像同步中