Connect to 100+ APIs (Google Workspace, Microsoft 365, GitHub, Notion, Slack, Airtable, HubSpot, etc.) with managed OAuth. Use this skill when users want to...
Security Analysis
high confidenceThis instruction-only skill is internally consistent with its description: it proxies requests to Maton.ai's API gateway and only asks for a single MATON_API_KEY, but that key is high-value so you should treat it like a password and verify Maton's trustworthiness before using it.
Name and description claim a managed OAuth gateway for many third‑party APIs and the SKILL.md only requires MATON_API_KEY and documents requests to Maton domains (gateway.maton.ai / ctrl.maton.ai). The requested environment variable and declared operations align with the stated purpose.
Runtime instructions are limited to calling Maton control and gateway endpoints and showing examples for calling native third‑party APIs via the gateway. The instructions do not request unrelated files, other environment variables, or system access. They do include examples that can read/modify third‑party resources (e.g., post messages, update Notion pages) — which is expected for a gateway but means the skill can perform destructive actions if the user or connections authorize them.
No install spec and no code files that run locally; this is instruction-only. That minimizes local install risk because nothing is downloaded or written to disk by the skill package itself.
Only one env var (MATON_API_KEY) is required, which is proportionate to a hosted API gateway. However, the MATON_API_KEY is a high-value credential: while the SKILL.md states the key alone does not access third‑party services, a valid key plus any already-authorized connections can be used to call many services and to list/create/delete connections via the control API. Treat it like a master token.
always is false and the skill is user-invocable; it does not request persistent 'always' presence or modify other skills or system-wide settings. Autonomous invocation (default) is normal for skills and not a standalone concern here.
Guidance
This skill appears to be what it says: it proxies calls to Maton.ai and requires only MATON_API_KEY. Before installing or enabling it: (1) only provide a MATON_API_KEY you trust (treat it like a password); (2) review Maton’s privacy/security, who operates the service, and whether you trust them to broker OAuth for your accounts; (3) audit and limit Maton connections (connect only the accounts/scopes you need); (4) avoid pasting the API key into public places or logs and rotate/revoke the key if compromised; (5) be careful when running commands that modify third‑party data (the docs include create/update/delete examples) — require explicit confirmation for destructive actions. If provenance of this package is important, verify the publisher (homepage/source is minimal/unknown in registry metadata) before use.
Latest Release
v1.0.61
- No user-facing changes in this release (version 1.0.61). - No file changes detected.
More by @byungkyu
Published by @byungkyu on ClawHub
