ClawHub

Api Gateway 1.0.64

v1.0.0

Connect to 100+ APIs (Google Workspace, Microsoft 365, GitHub, Notion, Slack, Airtable, HubSpot, etc.) with managed OAuth. Use this skill when users want to...

⭐ 0· 76·0 current·1 all-time
by@larry-at
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description claim a managed OAuth API gateway for many third-party services; the SKILL.md and reference files show how to call Maton endpoints and manage connections. Requesting a MATON_API_KEY is coherent with that purpose. The large set of 'references/*' README files are documentation for proxied services and are appropriate for a gateway-style skill.
✓
Instruction Scope
SKILL.md only instructs the agent to call Maton's gateway (gateway.maton.ai) and control endpoints (ctrl.maton.ai), set/read the MATON_API_KEY env var, and perform OAuth connect flows via URLs returned by the control API. It does not instruct reading unrelated files or other environment variables, nor does it direct data to unexpected external endpoints.
✓
Install Mechanism
This is an instruction-only skill with no install spec and no code files to execute. That minimizes on-disk installation risk.
ℹ
Credentials
The skill requires a single environment variable (MATON_API_KEY), which is proportionate for a managed-gateway service. Minor metadata inconsistency: registry metadata shows no 'primary credential' while MATON_API_KEY is required — it'd be clearer if MATON_API_KEY were declared as the primary credential in metadata, but this is not a functional mismatch.
✓
Persistence & Privilege
always:false and user-invocable:true (default) — no forced or permanent inclusion. Autonomous model invocation is allowed by default but not combined with other privilege escalation indicators here.
Scan Findings in Context
[no-code-to-scan] expected: The regex scanner had no code files to analyze because this is an instruction-only skill. The file manifest contains many reference README docs (routing info for proxied services) which is expected for an API gateway.
Assessment
This skill lets the agent call Maton’s API gateway on your behalf; it requires you to provide MATON_API_KEY and then to complete OAuth connect flows for each third‑party service you want accessed. Before installing: (1) confirm you trust Maton (https://maton.ai) because the gateway will hold OAuth tokens for any services you connect; (2) avoid placing MATON_API_KEY in shared or public environments, treat it like any API secret, and rotate it if compromised; (3) review Maton’s privacy/security docs and the scopes requested during each OAuth connect flow so the agent only gets access you intend; (4) if you need stronger isolation, consider using per-service credentials directly instead of a shared gateway key. The skill appears coherent with its stated purpose, but you should only install it if you trust the Maton provider and are comfortable with the gateway acting as an intermediary for your connected services.

Like a lobster shell, security has layers — review code before you run it.

latestvk97e85ns9gf7wjkjvekn45vjh583nbt3

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🧠 Clawdis
EnvMATON_API_KEY

Comments