API Gateway
PassAudited by ClawScan on May 7, 2026.
Overview
This appears to be a disclosed Maton API gateway skill, but it can use delegated account access to read or change third-party services, so approvals and scopes matter.
Install only if you intend to use Maton as an API gateway. Confirm the exact app, account, connection ID, endpoint, and request body before approving any change. Use least-privilege OAuth scopes, avoid exposing MATON_API_KEY, remove unneeded connections, and be especially cautious with payment, crypto, email, admin, or public-posting services.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If approved carelessly, the agent could send messages, update records, delete resources, or otherwise change connected services.
The skill is intended to make mutating API calls through a gateway. The documented approval protocol is a strong control, but users should notice that non-GET calls can change third-party accounts.
All non-GET requests are denied unless the user explicitly approves each one. Before any POST, PUT, PATCH, or DELETE call, present the user with: the exact connection ID, the full endpoint path, the request body, and the expected outcome
Only approve exact endpoints and request bodies you understand; use read-only checks first and prefer draft or reversible workflows where possible.
A leaked key or overly broad OAuth connection could expose or modify data across connected services.
The skill uses a Maton API key and delegated service connections. This is expected for the gateway, but it grants account-level authority that should be tightly scoped.
Treat `MATON_API_KEY` as a secret... Connection creation requires explicit user approval... Least-privilege scopes... Remove connections immediately after the task is complete if they are no longer needed
Use least-privilege scopes, do not paste secrets into chats or logs, rotate exposed keys, and delete connections that are no longer needed.
Installing a global CLI gives that package local execution ability on your machine.
The skill is instruction-only but recommends installing an external global CLI. This is central to the purpose, but the artifact does not pin a specific CLI version.
npm install -g @maton-ai/cli ... brew install maton-ai/cli/maton
Install only from Maton’s official sources, review the package/homebrew formula if your environment is sensitive, and keep the CLI updated.
Third-party account data may transit the Maton service when the gateway is used.
Requests and responses for connected services route through Maton’s gateway rather than going directly from the agent to each provider.
Managed API routing for third-party services, provided by Maton... Use `https://api.maton.ai/` with the app-prefixed routes
Use this only for services and data you are comfortable routing through Maton, and review Maton’s privacy/security terms for sensitive accounts.