ClawHub

Lemonsqueezy Admin

v0.1.0

Admin CLI for Lemon Squeezy stores. View orders, subscriptions, and customers.

⭐ 1· 1.8k·0 current·0 all-time
by@abakermi
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The name/description (Lemon Squeezy admin) align with requesting LEMONSQUEEZY_API_KEY, but the SKILL.md demonstrates usage of a 'ls-admin' CLI tool. No such binary is required, provided, or described in an install spec, which is inconsistent with the presented CLI-centric workflow.
ℹ
Instruction Scope
Instructions are narrowly scoped to setting the Lemon Squeezy API key and running example CLI commands; they do not ask the agent to read unrelated files or exfiltrate data. However, the guidance assumes existence of 'ls-admin' (not present), so it's unclear whether the agent should call the Lemon Squeezy API directly or invoke a separate tool.
✓
Install Mechanism
There is no install spec and no code files (instruction-only), which minimizes installation risk. Because nothing is downloaded or written by the skill itself, there is low install-supply-chain risk — but also no executable provided to match the documented CLI usage.
✓
Credentials
The skill requests a single LEMONSQUEEZY_API_KEY, which is appropriate for an admin client. No additional unrelated secrets or config paths are requested.
✓
Persistence & Privilege
The skill is not marked always:true and uses default model invocation settings. It does not request persistent system-wide changes or other skills' credentials.
What to consider before installing
This skill appears to be an instruction-only wrapper for Lemon Squeezy and sensibly asks for your LEMONSQUEEZY_API_KEY. However, the SKILL.md shows running a 'ls-admin' CLI that is not provided or installed by the skill. Before installing or supplying your API key, ask the publisher: (1) where does 'ls-admin' come from — is there an official install step or binary? (2) If the skill runs API calls itself, request the source or exact commands it will execute. Do not share your API key unless you trust the skill's source and have clarity on how the key will be used/stored. If the publisher cannot explain the missing CLI, treat the skill as incomplete and avoid installing it.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fstk9qeatq0cvgbbmrzvsr5808046

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🍋 Clawdis
EnvLEMONSQUEEZY_API_KEY

Comments