Affonso - Affiliate Marketing Software
v1.0.0Manage affiliate marketing programs via the Affonso CLI — create affiliates, track referrals, handle commissions, process payouts, and configure program sett...
⭐ 0· 51·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the requested artifacts: the skill expects an 'affonso' CLI binary and an AFFONSO_API_KEY environment variable, which are appropriate for a CLI-based affiliate-management skill. Minor inconsistency: the SKILL.md header includes an install hint (npm package '@affonso/cli') while the registry metadata indicates 'no install spec' — this is a documentation/packaging mismatch but does not change capability alignment.
Instruction Scope
SKILL.md instructs the agent to run only Affonso CLI commands (always with --json), to verify auth with 'affonso whoami', and to avoid browser-based login. The instructions do not ask the agent to read arbitrary files, other env vars, or transmit data to unknown endpoints. Command options do allow sending IPs, user-agent strings, and payment references (expected for this domain) but those are part of legitimate product functionality.
Install Mechanism
This is instruction-only (no install spec in registry), so nothing will be written to disk by the skill itself. The SKILL.md metadata references installing '@affonso/cli' via node/npm — if a user chooses to install the CLI, that would be an external npm dependency. That install path is reasonable but the documentation mismatch should be clarified (no automated install provided by the skill).
Credentials
Only AFFONSO_API_KEY is required, which is proportional and expected for an API-driven CLI. No other unrelated secrets or config paths are requested. Note: the CLI supports --api-key and --base-url overrides and the affonso config can store keys/URLs — users should be aware the CLI will use those values when invoked.
Persistence & Privilege
The skill does not request 'always: true', has no elevated persistence or system-wide config changes, and does not claim to modify other skills. Autonomous invocation is allowed (platform default) but nothing in the skill increases privilege beyond normal CLI usage.
Assessment
This skill is an instruction-only adapter for the official Affonso CLI and appears coherent. Before installing or using it: (1) ensure you actually have the official 'affonso' binary or install the official '@affonso/cli' package from a trusted source (verify npm publisher and package contents); (2) provide an AFFONSO_API_KEY with least privilege needed (avoid using a full-owner key if possible); (3) be careful with destructive commands (payouts, delete) — the skill correctly warns to confirm deletes; (4) be aware the CLI may send data (including any IP or user-agent you pass) to the Affonso API or any base-url you configure; (5) clarify the doc mismatch about automated install if you expect the skill to install the CLI for you.Like a lobster shell, security has layers — review code before you run it.
latestvk9764rhtenq82dw3a63d7hk1xx84rr5g
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binsaffonso
EnvAFFONSO_API_KEY