Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed third-party API gateway, but it asks for broader command/file permissions and auto-activation than its read-only description justifies.
Install only if you intend to route third-party service queries through Maton and are comfortable granting command execution and file-write capable tooling despite the free-tier read-only description. Prefer explicit invocation for named services, use read-only scopes, avoid sensitive broad queries, and confirm what data the hosted gateway receives and retains.
The manifest and descriptive metadata present the skill as a read-only third-party API gateway while advertising broader write and command-execution capabilities. This creates a trust-boundary violation: reviewers and users may approve the skill based on its benign description while the runtime permissions allow far more powerful actions.
The description explicitly says '支持中文交互' while the display name is also Chinese, but the file does not clearly offer a user language choice or explain that Chinese is optional. This can create a locale/language policy concern if the skill defaults to a specific language without user opt-in.
The skill repeatedly claims it is limited to read-only GET/list operations, but the manifest exposes both exec and write tool capabilities. That mismatch can mislead users and downstream agents into granting or invoking materially broader privileges than the documentation suggests, enabling unauthorized command execution or file modification if the skill is activated.
The skill directs traffic to an external hosted endpoint, which means user inputs and queried third-party data may be transmitted outside the local agent boundary. In this context, external transmission is expected for an API gateway, but it is still security-relevant because the skill is broadly triggered and inconsistently describes its privileges, increasing the risk of unintended data disclosure.
# API 网关集成路由（免费版）
托管式 API 网关路由服务免费版。通过统一的 API 路由地址 `https://api.maton.ai/` 连接第三方服务,支持只读 GET 操作与基础连接管理.
> **升级提示**: 触发器管理、事件重放、写操作审批流程、高危操作审查、多语言调用等高级功能为付费版专享。升级付费版解锁完整能力.
## 输入参数
| 参数名 | 类型 | 必填 | 说明 |
The documented routing model sends requests to a unified external gateway for Slack, Gmail, Stripe, and other services. While this is part of the product design, it centralizes sensitive metadata and query contents in a third-party service, which becomes more dangerous because the skill's documentation understates its broader capabilities and could lead to unanticipated transmissions.
配置后需重启会话或开启新终端生效。API Key应妥善保管,避免泄露到版本控制系统.
## 能力矩阵
- **统一路由**: 通过 `https://api.maton.ai/<app>/...` 路由访问 Slack、Gmail、Stripe 等服务
- **只读 GET 操作**: 列出频道、查询客户、搜索联系人等只读操作
- **连接列表**: 查看已有连接与认证状态
- **认证验证**: 通过 `maton whoami` 验证 API Key 有效性
The trigger condition states the skill should auto-activate for broadly defined Development-related tasks, which is overly expansive for a skill with external API connectivity and advertised exec/write tooling. Overbroad activation increases the chance of unintended invocation, data exposure to external services, or accidental use of privileged capabilities outside the user's intent.
The feature overview says the skill supports file reading, parsing, and writing, which contradicts the core positioning as a read-only API gateway. This inconsistency expands the apparent attack surface and can cause an agent or operator to permit filesystem actions that were not expected from the earlier safety claims.
No suspicious patterns detected.