Tapfiliate
v1.0.2Tapfiliate integration. Manage Affiliates, Referrals, Conversions, Programs, Invoices. Use when the user wants to interact with Tapfiliate data.
⭐ 0· 105·0 current·0 all-time
byMembrane Dev@membranedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Tapfiliate integration) matches the instructions: all runtime actions use Membrane to manage Tapfiliate resources (connections, actions, proxy requests). There are no unrelated service credentials or unexplained capabilities requested.
Instruction Scope
SKILL.md confines runtime steps to installing and using the Membrane CLI, creating a connection, listing actions, running actions, and proxying requests to Tapfiliate via Membrane. It does not instruct reading arbitrary local files or exfiltrating data to unexpected endpoints. It does rely on browser-based login or headless completion flow, which is documented.
Install Mechanism
There is no formal install spec in the registry metadata (instruction-only), but the SKILL.md tells users to run 'npm install -g @membranehq/cli' and uses npx in examples. Installing a global npm package executes code from the npm registry—this is a standard but non-trivial system change and should be done from a trusted environment. No opaque download URLs are used.
Credentials
The skill declares no required environment variables or credentials and explicitly instructs not to ask users for Tapfiliate API keys, relying on Membrane to manage auth. That is proportionate for a connector-based integration. Note: using Membrane means Membrane's servers will see proxied requests and stored credentials—so trust in Membrane is required.
Persistence & Privilege
The skill does not request persistent/always-on presence, does not modify other skills, and has normal autonomous invocation settings. It does not request system-level privileges beyond installing a CLI per its instructions.
Assessment
This skill is an instruction-only connector that expects you to install and use the @membranehq/cli (via npm) to connect to Tapfiliate. Before installing or using it: (1) verify you trust Membrane (their CLI and servers will handle/authenticate your Tapfiliate credentials and proxy requests); (2) be aware that 'npm install -g' executes code from the npm registry—install in a controlled environment or with appropriate policies; (3) there are no hidden env-vars or files asked for by the SKILL.md, but there is no code bundled with the skill to audit, so review Membrane's docs and trust model if you care about where your affiliate data/credentials are stored. If you need a higher assurance, run CLI commands from an isolated machine or container and inspect Membrane's open-source repo and privacy/security docs before proceeding.Like a lobster shell, security has layers — review code before you run it.
latestvk975t5vg3xzcaqs3gv86m9g7nh843pj9
License
MIT-0
Free to use, modify, and redistribute. No attribution required.