Mayar Payment Integration

Integrate Mayar.id payments to create invoices, generate payment links, track Indonesian payment methods, manage subscriptions, and automate payment workflows.

What to consider before installing: - Metadata mismatch: the skill does not declare that it needs an API token yet the instructions require you to store a Mayar API token and modify mcporter config; insist the publisher update metadata to list required credentials. - Secret exposure risk: the guide shows placing the token in a credentials file and in command args (--header Authorization:YOUR_API_TOKEN_HERE). Passing secrets in command arguments can expose them via process lists and logs. Prefer using environment variables, a secrets store, or mcporter's supported secret mechanism if available. - Runtime downloads: the mcporter config relies on npx mcp-remote which will fetch and run code from npm at runtime. Review and verify the mcp-remote package/maintainer before allowing it to run in production. - Test in isolation: try this first with sandbox API keys and in a controlled/test environment. Verify webhook URLs and token handling before moving to production. - Review config changes: the instructions modify config/mcporter.json — back up existing configs and confirm you are comfortable with persistent changes. - Verify endpoints: confirm domains (mcp.mayar.id, api.mayar.id / api.mayar.club) are legitimate official endpoints for your organization. If you need this integration, it's probably usable, but ask the publisher to fix metadata (declare required credential), and revise instructions to avoid inlining secrets into command args and to document safe secret handling. If you cannot verify package sources or are uncomfortable with config changes, do not enable it in a production environment.

Type: OpenClaw Skill Name: mayar-payment Version: 1.0.0 The skill bundle is designed for Mayar.id payment integration, which is a legitimate purpose. However, it includes instructions for setup using `npx -y mcp-remote` in `SKILL.md`, which involves fetching and executing code from npm, posing a supply chain risk. Additionally, the `references/integration-examples.md` file contains JavaScript snippets that use `execSync` to run `mcporter` commands. While these actions are plausibly needed for the stated purpose of the skill, `npx` and `execSync` are powerful shell execution capabilities that, without clear malicious intent, elevate the classification to suspicious due to the inherent risks of executing external code and shell commands.