70High
This skill grants broad access to sensitive external APIs and
Behavior Analysis
Description verified — behavior matches claim
Claims to do
API Gateway: Passthrough proxy for direct access to third-party APIs using managed OAuth connections, provided by [Maton](https://maton.ai). The API gateway lets you call native API endpoints directly.
Actually does
This skill acts as an API gateway, proxying HTTP GET, POST, PUT, PATCH, and DELETE requests to over 100 third-party APIs (e.g., Slack, HubSpot, Google Sheets, Salesforce, Notion, Stripe) via `https://gateway.maton.ai`. It uses a `MATON_API_KEY` for authentication to Maton and manages OAuth connections to these services through `https://ctrl.maton.ai`, allowing users to list, create, get, and delete connections.
Skill Info
Namebyungkyu/api-gateway
Registryclawhub
Version1.0.58
PURLpkg:clawhub/byungkyu/api-gateway@1.0.58
Stars341
Downloads68,385
Installs532
Source
SHA-2565e06bfef663f...
SHA-12490254e3b48...
MD5c29716794372...
TLSHced2a387f621...
ssdeep768:AV79ef9V...
Size30,812 bytes
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
ClawHubDocs
openclaw skills install byungkyu/api-gatewayAssessments (1)
AI Agent Traps ↗Broad access to sensitive third-party APIshighimpact
The skill provides a gateway to over 100 external APIs, many of which handle highly sensitive data (e.g., financial, personal, business-critical). A compromised or misdirected agent could leverage this broad access to cause significant data exfiltration, financial actions, or data destruction.
90% confidenceline 100
Supported Services table listing 100+ APIs
Dynamic management of third-party API connectionsmediumautonomy abuse
The skill exposes endpoints for an agent to programmatically create, list, retrieve, and delete connections to external services. This capability, while legitimate, could be abused by a malicious agent to create excessive connections, delete critical ones, or manage access without explicit user confirmation.
80% confidenceline 60
https://ctrl.maton.ai/connections (POST, GET, DELETE)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/clawhub/byungkyu/api-gateway)HTML
<a href="https://mondoo.com/ai-agent-security/skills/clawhub/byungkyu/api-gateway"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/byungkyu/api-gateway.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/clawhub/byungkyu/api-gateway.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow