Stripe Tax
v1.0.2Stripe Tax integration. Manage data, records, and automate workflows. Use when the user wants to interact with Stripe Tax data.
⭐ 0· 82·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description say 'Stripe Tax' and the SKILL.md instructs using Membrane connectors and proxy requests to Stripe Tax. There are no unrelated env vars, binaries, or config paths requested by the skill manifest — the actions described (connectors, action runs, proxying) are coherent with the stated purpose.
Instruction Scope
All runtime instructions are to install and use the Membrane CLI (membrane / npx @membranehq/cli) to create connections, list actions, and proxy requests to Stripe Tax. The instructions do not ask the agent to read unrelated files or environment variables. Note: using the proxy means requests and credentials are handled by Membrane's service (i.e., data/transmitted requests go to Membrane's servers), which is expected but important to understand.
Install Mechanism
The skill is instruction-only (no install spec), but SKILL.md tells users/agents to install @membranehq/cli via npm or use npx. Installing or running packages from npm/npx is common for CLIs but carries the usual supply-chain risk (running code fetched from the registry). This is expected for a Membrane-based integration, but verify the package/publisher before installing or let a human perform the install.
Credentials
The manifest requests no environment variables or credentials. The instructions explicitly say to let Membrane handle credentials and not to ask users for API keys — this is proportionate for a connector-based integration.
Persistence & Privilege
always is false and there is no install spec that forces persistent system changes from the skill itself. The SKILL.md does instruct installing a CLI, which is a user action outside the skill, and the skill uses the platform's normal autonomous-invocation default (not flagged).
Assessment
This skill is coherent: it delegates auth and API calls to Membrane and asks you to use the Membrane CLI. Before installing or allowing an agent to run the commands, verify you trust Membrane and the @membranehq/cli npm package (check the publisher, npm page, GitHub repo, and privacy/security docs). Prefer human-installed CLI usage rather than letting an autonomous agent run npm install globally. Remember that Membrane will proxy requests and hold/oauth-refresh credentials for connectors — ensure you are comfortable granting those connector permissions to access your Stripe data and restrict scope where possible. Avoid pasting raw API keys into chat; create connections through Membrane as instructed.Like a lobster shell, security has layers — review code before you run it.
latestvk97a7577cenb6f2ne0j914tv318424pn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.