2Checkout
v1.0.02Checkout integration. Manage data, records, and automate workflows. Use when the user wants to interact with 2Checkout data.
⭐ 0· 53·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description (2Checkout integration) match the instructions: all actions are performed through the Membrane CLI which proxies to 2Checkout. There are no unrelated required env vars, binaries, or config paths.
Instruction Scope
SKILL.md stays on-topic: it tells the agent/user to install and use the Membrane CLI, run login/connect/action commands, and use membrane request to proxy API calls. It does not instruct reading unrelated files or exfiltrating local secrets. Note: it does recommend a global npm install which writes a binary to disk (expected for a CLI).
Install Mechanism
The registry metadata contains no install spec, but the instructions require npm install -g @membranehq/cli. Installing a global npm package runs third-party code and creates binaries — a moderate-risk operation. This is expected for a CLI-based integration, but you should verify the package (publisher, npm/github repo) before installing.
Credentials
The skill declares no required env vars or credentials. It relies on the user's Membrane account/connection flow to manage 2Checkout credentials server-side, which is proportionate to its purpose.
Persistence & Privilege
The skill does not request permanent/always-on inclusion. It is user-invocable and allows normal autonomous invocation by agents (platform default). Installing the Membrane CLI creates a local binary but the skill itself does not request system-wide privileges or modify other skills' configs.
Assessment
This skill appears coherent for connecting to 2Checkout via Membrane, but before installing or authenticating consider: 1) Verify the @membranehq/cli package and its maintainers on npm/GitHub (publisher, recent commits, issues). 2) Installing a global npm package runs third-party code and adds a binary to your system — only install if you trust the publisher. 3) The Membrane service will broker your 2Checkout credentials and proxied requests — review Membrane's privacy/security docs to understand where your data and tokens reside. 4) If you prefer minimal exposure, run the CLI in an isolated environment (VM/container) or use a least-privilege account for the 2Checkout connection. 5) If you need higher assurance, request the skill author/publisher identity or source code before proceeding.Like a lobster shell, security has layers — review code before you run it.
latestvk97esy60jcbm8pcaf94pq7brcx84d7fj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.