Payfit
v1.0.0PayFit integration. Manage data, records, and automate workflows. Use when the user wants to interact with PayFit data.
⭐ 0· 82·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
Name and description correspond to PayFit integration. All required actions in SKILL.md involve installing and using the Membrane CLI and creating a connector — these are expected for a connector-style integration.
Instruction Scope
Runtime instructions are limited to installing the Membrane CLI, authenticating via Membrane, listing/connecting actions, running actions, and proxying requests to the PayFit API. The skill does not instruct the agent to read unrelated files, access unrelated environment variables, or exfiltrate data to unexpected endpoints.
Install Mechanism
The skill is instruction-only (no install spec in the registry), but it instructs users to run a global npm install for @membranehq/cli. Installing global npm packages executes upstream code on the host — that's expected here but the user should verify the package origin and trustworthiness before installing.
Credentials
No environment variables, secrets, or config paths are requested by the skill. Authentication is delegated to Membrane (the instructions explicitly say not to ask users for API keys), which aligns with the described behavior.
Persistence & Privilege
Skill does not request always:true or other elevated persistence. It is user-invocable and permits normal autonomous invocation (disable-model-invocation=false), which is the platform default and appropriate for an integration skill.
Assessment
This skill appears coherent and limited to acting as a Membrane-powered PayFit integration. Before installing or using it: 1) Confirm you trust the @membranehq/cli package (npm global installs run code on your machine) and prefer the official package/repository; 2) Understand that Membrane will act as a proxy and hold the connector credentials server-side — review Membrane's privacy/security and terms if you care about where PayFit data is stored or logged; 3) Be aware that, if you allow the agent to call this skill autonomously, it can invoke the Membrane CLI actions you've authorized; if you want tighter control, restrict autonomous invocation in agent settings. If any instructions in a different distribution of this skill requested unrelated credentials, file access, or outbound endpoints, that would change this assessment.Like a lobster shell, security has layers — review code before you run it.
latestvk97bvh95zzmfb2b0q8gwdg8xdh84hnsq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.