ClawHub

Tomato Pay

v1.0.0

Tomato pay integration. Manage data, records, and automate workflows. Use when the user wants to interact with Tomato pay data.

⭐ 0· 28·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name and description (Tomato Pay integration) match the SKILL.md: all instructions are about using the Membrane CLI to discover connectors, create connections, run actions, or proxy requests to Tomato Pay. No unrelated capabilities or credentials are requested.
✓
Instruction Scope
Runtime instructions stay on‑topic: install and run the Membrane CLI, log in, find/connect a Tomato Pay connector, run actions, or proxy requests. The instructions do not ask the agent to read arbitrary local files, search system state, or exfiltrate unrelated data. They do require network access and interactive/browser auth.
ℹ
Install Mechanism
This is an instruction‑only skill (no install spec). It tells users to install @membranehq/cli via npm -g. Installing a global npm package is a common pattern but carries moderate risk if the package is malicious or compromised; the SKILL.md references getmembrane.com and a GitHub repo which helps traceability but the skill did not provide checksums or pinned versions.
ℹ
Credentials
The skill requests no env vars or local secrets and relies on Membrane to manage authentication (browser login / connection flow). This is proportionate, but it does require trusting the Membrane service and CLI to store/handle credentials and to proxy API requests to Tomato Pay.
✓
Persistence & Privilege
No elevated persistence requested: always is false, no config paths or system modifications are declared. The skill does instruct installing a CLI and running it, which is normal for an integration skill.
Assessment
This skill appears coherent for integrating Tomato Pay via Membrane, but before installing or running anything: (1) Verify and trust the @membranehq/cli package and the Membrane service (check the npm package page and GitHub repo linked in the SKILL.md). (2) Prefer installing the CLI in a controlled environment (use a VM, container, or Node version manager rather than system-wide -g install). (3) Understand that Membrane will handle credentials and proxy requests — you are trusting a third party with access to Tomato Pay API traffic. (4) Review Membrane's privacy/security docs and the connector implementation if you need assurance about what data is sent/stored. (5) Avoid running CLI commands or pasting codes provided by unknown parties; follow the documented login flow listed in SKILL.md.

Like a lobster shell, security has layers — review code before you run it.

latestvk974svesbtwfbfee45ky8x9qdx849awq

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments