hyperext-sage-50 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hyperext-sage-50 (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Hyperext: Sage 50 is a data integration tool that connects Sage 50 accounting software with other business applications. It's used by businesses that want to automate data transfer between Sage 50 and their CRM, e-commerce platforms, or other systems.
Official docs: https://developer.sage.com/accounting/reference/sage50/
This skill uses the Membrane CLI to interact with Hyperext: Sage 50. Membrane handles authentication and credentials refresh automatically — so you can focus on the integration logic rather than auth plumbing.
Install the Membrane CLI so you can run membrane from the terminal:
npm install -g @membranehq/cli@latestmembrane login --tenant --clientName=<agentType>This will either open a browser for authentication or print an authorization URL to the console, depending on whether interactive mode is available.
Headless environments: The command will print an authorization URL. Ask the user to open it in a browser. When they see a code after completing login, finish with:
membrane login complete <code>Add --json to any command for machine-readable JSON output.
Agent Types : claude, openclaw, codex, warp, windsurf, etc. Those will be used to adjust tooling to be used best with your harness
Use membrane connection ensure to find or create a connection by app URL or domain:
membrane connection ensure "https://www.hyperext.com/" --jsonThe user completes authentication in the browser. The output contains the new connection id.
This is the fastest way to get a connection. The URL is normalized to a domain and matched against known apps. If no app is found, one is created and a connector is built automatically.
If the returned connection has state: "READY", skip to Step 2.
#### 1b. Wait for the connection to be ready
If the connection is in BUILDING state, poll until it's ready:
npx @membranehq/cli connection get <id> --wait --jsonThe --wait flag long-polls (up to --timeout seconds, default 30) until the state changes. Keep polling until state is no longer BUILDING.
The resulting state tells you what to do next:
clientAction object describes the required action:clientAction.type — the kind of action needed:"connect" — user needs to authenticate (OAuth, API key, etc.). This covers initial authentication and re-authentication for disconnected connections."provide-input" — more information is needed (e.g. which app to connect to).clientAction.description — human-readable explanation of what's needed.clientAction.uiUrl (optional) — URL to a pre-built UI where the user can complete the action. Show this to the user when present.clientAction.agentInstructions (optional) — instructions for the AI agent on how to proceed programmatically.After the user completes the action (e.g. authenticates in the browser), poll again with membrane connection get <id> --json to check if the state moved to READY.
error field for details.Search using a natural language description of what you want to do:
membrane action list --connectionId=CONNECTION_ID --intent "QUERY" --limit 10 --jsonYou should always search for actions in the context of a specific connection.
Each result includes id, name, description, inputSchema (what parameters the action accepts), and outputSchema (what it returns).
| Name | Key | Description |
|---|---|---|
| List Customers | list-customers | Search and list customers from Sage 50. |
| List Products | list-products | Search and list products from Sage 50. |
| List Suppliers | list-suppliers | Search and list suppliers from Sage 50. |
| List Sales Invoices | list-sales-invoices | Search and list sales invoices from Sage 50. |
| List Purchase Orders | list-purchase-orders | Search and list purchase orders from Sage 50. |
| List Sales Orders | list-sales-orders | Search and list sales orders from Sage 50. |
| List Projects | list-projects | Search and list projects from Sage 50. |
| Get Customer | get-customer | Retrieve a single customer record by their account reference. |
| Get Product | get-product | Retrieve a single product record by its code. |
| Get Supplier | get-supplier | Retrieve a single supplier record by their account reference. |
| Get Sales Invoice | get-sales-invoice | Retrieve a single sales invoice by its invoice number. |
| Get Purchase Order | get-purchase-order | Retrieve a single purchase order by its order number. |
| Get Sales Order | get-sales-order | Retrieve a single sales order by its order number. |
| Get Project | get-project | Retrieve a single project by its reference. |
| Create Customer | create-customer | Create a new customer in Sage 50. |
| Create Product | create-product | Create a new product in Sage 50. |
| Create Supplier | create-supplier | Create a new supplier in Sage 50. |
| Create Sales Invoice | create-sales-invoice | Create a new sales invoice in Sage 50. |
| Create Purchase Order | create-purchase-order | Create a new purchase order in Sage 50. |
| Create Sales Order | create-sales-order | Create a new sales order in Sage 50. |
membrane action run <actionId> --connectionId=CONNECTION_ID --jsonTo pass JSON parameters:
membrane action run <actionId> --connectionId=CONNECTION_ID --input '{"key": "value"}' --jsonThe result is in the output field of the response.
When the available actions don't cover your use case, you can send requests directly to the Hyperext: Sage 50 API through Membrane's proxy. Membrane automatically appends the base URL to the path you provide and injects the correct authentication headers — including transparent credential refresh if they expire.
membrane request CONNECTION_ID /path/to/endpointCommon options:
| Flag | Description |
|---|---|
-X, --method | HTTP method (GET, POST, PUT, PATCH, DELETE). Defaults to GET |
-H, --header | Add a request header (repeatable), e.g. -H "Accept: application/json" |
-d, --data | Request body (string) |
--json | Shorthand to send a JSON body and set Content-Type: application/json |
--rawData | Send the body as-is without any processing |
--query | Query-string parameter (repeatable), e.g. --query "limit=10" |
--pathParam | Path parameter (repeatable), e.g. --pathParam "id=123" |
membrane action list --intent=QUERY (replace QUERY with your intent) to find existing actions before writing custom API calls. Pre-built actions handle pagination, field mapping, and edge cases that raw API calls miss.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.