lightspeed-r-series — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited lightspeed-r-series (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Lightspeed R-Series is a retail point of sale and inventory management system. It's used by retailers to manage sales, track inventory, and gain insights into their business performance. Think of it as a modern cash register and business analytics tool combined.
Official docs: https://developers.lightspeedhq.com/r-series/
Use action names and parameters as needed.
This skill uses the Membrane CLI to interact with Lightspeed R-Series. Membrane handles authentication and credentials refresh automatically — so you can focus on the integration logic rather than auth plumbing.
Install the Membrane CLI so you can run membrane from the terminal:
npm install -g @membranehq/cli@latestmembrane login --tenant --clientName=<agentType>This will either open a browser for authentication or print an authorization URL to the console, depending on whether interactive mode is available.
Headless environments: The command will print an authorization URL. Ask the user to open it in a browser. When they see a code after completing login, finish with:
membrane login complete <code>Add --json to any command for machine-readable JSON output.
Agent Types : claude, openclaw, codex, warp, windsurf, etc. Those will be used to adjust tooling to be used best with your harness
Use membrane connection ensure to find or create a connection by app URL or domain:
membrane connection ensure "https://www.lightspeedhq.com/pos/retail/" --jsonThe user completes authentication in the browser. The output contains the new connection id.
This is the fastest way to get a connection. The URL is normalized to a domain and matched against known apps. If no app is found, one is created and a connector is built automatically.
If the returned connection has state: "READY", skip to Step 2.
#### 1b. Wait for the connection to be ready
If the connection is in BUILDING state, poll until it's ready:
npx @membranehq/cli connection get <id> --wait --jsonThe --wait flag long-polls (up to --timeout seconds, default 30) until the state changes. Keep polling until state is no longer BUILDING.
The resulting state tells you what to do next:
clientAction object describes the required action:clientAction.type — the kind of action needed:"connect" — user needs to authenticate (OAuth, API key, etc.). This covers initial authentication and re-authentication for disconnected connections."provide-input" — more information is needed (e.g. which app to connect to).clientAction.description — human-readable explanation of what's needed.clientAction.uiUrl (optional) — URL to a pre-built UI where the user can complete the action. Show this to the user when present.clientAction.agentInstructions (optional) — instructions for the AI agent on how to proceed programmatically.After the user completes the action (e.g. authenticates in the browser), poll again with membrane connection get <id> --json to check if the state moved to READY.
error field for details.Search using a natural language description of what you want to do:
membrane action list --connectionId=CONNECTION_ID --intent "QUERY" --limit 10 --jsonYou should always search for actions in the context of a specific connection.
Each result includes id, name, description, inputSchema (what parameters the action accepts), and outputSchema (what it returns).
| Name | Key | Description |
|---|---|---|
| List Items | list-items | Retrieve a list of all items (products) in the account |
| List Sales | list-sales | Retrieve a list of all sales in the account |
| List Customers | list-customers | Retrieve a list of all customers in the account |
| List Vendors | list-vendors | Retrieve a list of all vendors (suppliers) in the account |
| List Shops | list-shops | Retrieve a list of all shops (store locations) in the account |
| List Categories | list-categories | Retrieve a list of all categories in the account |
| List Employees | list-employees | Retrieve a list of all employees in the account |
| List Purchase Orders | list-purchase-orders | Retrieve a list of all purchase orders (vendor orders) in the account |
| Get Item | get-item | Retrieve a single item (product) by ID |
| Get Sale | get-sale | Retrieve a single sale by ID |
| Get Customer | get-customer | Retrieve a single customer by ID |
| Get Vendor | get-vendor | Retrieve a single vendor (supplier) by ID |
| Get Shop | get-shop | Retrieve a single shop (store location) by ID |
| Get Category | get-category | Retrieve a single category by ID |
| Get Employee | get-employee | Retrieve a single employee by ID |
| Get Purchase Order | get-purchase-order | Retrieve a single purchase order by ID |
| Create Item | create-item | Create a new item (product) in Lightspeed Retail |
| Create Sale | create-sale | Create a new sale in Lightspeed Retail |
| Create Customer | create-customer | Create a new customer in Lightspeed Retail |
| Update Item | update-item | Update an existing item (product) |
membrane action run <actionId> --connectionId=CONNECTION_ID --jsonTo pass JSON parameters:
membrane action run <actionId> --connectionId=CONNECTION_ID --input '{"key": "value"}' --jsonThe result is in the output field of the response.
When the available actions don't cover your use case, you can send requests directly to the Lightspeed R-Series API through Membrane's proxy. Membrane automatically appends the base URL to the path you provide and injects the correct authentication headers — including transparent credential refresh if they expire.
membrane request CONNECTION_ID /path/to/endpointCommon options:
| Flag | Description |
|---|---|
-X, --method | HTTP method (GET, POST, PUT, PATCH, DELETE). Defaults to GET |
-H, --header | Add a request header (repeatable), e.g. -H "Accept: application/json" |
-d, --data | Request body (string) |
--json | Shorthand to send a JSON body and set Content-Type: application/json |
--rawData | Send the body as-is without any processing |
--query | Query-string parameter (repeatable), e.g. --query "limit=10" |
--pathParam | Path parameter (repeatable), e.g. --pathParam "id=123" |
membrane action list --intent=QUERY (replace QUERY with your intent) to find existing actions before writing custom API calls. Pre-built actions handle pagination, field mapping, and edge cases that raw API calls miss.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.