Is dowands/affiliatematic safe?

Affiliatematic is a documentation-only affiliate marketing integration skill containing no executable code, no prompt injection, and no malicious installation behavior — the git clone was clean, canary files were untouched, and all network activity during installation was limited to expected GitHub and Ubuntu servers. The meaningful risks are downstream rather than direct: the skill guides users to embed unpinned third-party JavaScript from affiliatematic.com on their websites (creating a persistent supply chain attack surface), and it promotes an unverified service whose business model creates opportunity for affiliate commission theft via tag substitution.