Upayments
v1.0.0UPayments integration. Manage data, records, and automate workflows. Use when the user wants to interact with UPayments data.
⭐ 0· 54·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the instructions: the SKILL.md explains using the Membrane CLI to manage UPayments resources and automation. No unrelated credentials, binaries, or install artifacts are requested, so capability requirements align with the stated purpose.
Instruction Scope
Instructions are limited to installing and using the Membrane CLI, logging in, creating a connection to UPayments, listing actions, running actions, and optionally proxied API requests via Membrane. This scope is appropriate, but note that proxying requests means traffic and data will pass through Membrane's service (privacy consideration).
Install Mechanism
No built-in install spec in the skill bundle; the doc recommends installing @membranehq/cli with npm (global install example). This is a common approach but installing a global npm package executes third-party code on the host — verify package authenticity (npm publisher, GitHub repo) before installing.
Credentials
The skill requests no environment variables or secrets and explicitly tells users not to provide API keys directly, instead to use Membrane connections. The lack of credential requests is proportionate to an instruction-only connector guide.
Persistence & Privilege
Skill is not always-enabled, does not request elevated platform privileges, and does not modify other skills or system-wide settings. Autonomous invocation is enabled by default (normal for skills) but not combined with other concerning flags.
Assessment
This skill is an instructions doc for the Membrane CLI and looks internally consistent. Before installing or running commands: (1) verify the Membrane CLI package and its GitHub repository/publisher to ensure you trust the code that will run on your machine; (2) prefer using npx for one-off runs instead of a global npm install if you want less persistent footprint; (3) be aware that using Membrane's connector/proxy routes API traffic through Membrane's servers — review Membrane's privacy/security docs and the permissions requested during the OAuth/connect flow; (4) do not paste unrelated secrets into commands or inputs, and review any JSON you send via membrane request to avoid leaking sensitive data; (5) if you need stronger assurance, test the flow in an isolated environment or with test credentials first.Like a lobster shell, security has layers — review code before you run it.
latestvk97caxj2qp80bgj0m4kp233r7h84adtg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.