Self-Integration

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:48 PM UTC
• Version: 1.1.2

Overview

This skill is a broad Membrane integration that discloses powerful external-app access, but it can send a high-privilege token and action data to a configurable API endpoint without documented validation.

Review this before installing. Use it only if you trust Membrane with the connected apps and the actions this token can perform. Keep MEMBRANE_API_URL fixed to the official HTTPS Membrane API unless you intentionally operate a trusted deployment, scope and rotate MEMBRANE_TOKEN carefully, and require explicit user approval before state-changing actions such as posting messages, modifying records, or creating tasks.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:13

Finding

Configurable API Endpoint Can Expose a High-Privilege Bearer Token

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:11-27, with related disclosures at SKILL.md:331-340
Vulnerability Type: Unrestricted credential destination and missing transport enforcement
Risk Level: High

Vulnerable Code

markdown

metadata:
  author: Membrane Inc
  version: "1.0.0"
  homepage: https://getmembrane.com
  openclaw:
    requires:
      env:
        - MEMBRANE_TOKEN
        - MEMBRANE_API_URL
    primaryEnv: MEMBRANE_TOKEN
    homepage: https://getmembrane.com
---

# Self-Integration

Connect to any external app and perform actions on it. Uses the [Membrane](https://getmembrane.com) API.

## Making API Requests

All requests go to `${MEMBRANE_API_URL:-https://api.getmembrane.com}` with a Bearer token:

Authorization: Bearer $MEMBRANE_TOKEN Content-Type: application/json

text

The documented data flow confirms that sensitive information is sent to the configurable destination:

markdown

| Endpoint | Data Sent |
|---|---|
| `${MEMBRANE_API_URL:-https://api.getmembrane.com}/*` | API token, connection parameters, action inputs, agent prompts |

## Security & Privacy

- All data is sent to the Membrane API over HTTPS.
- `MEMBRANE_TOKEN` is a high-privilege credential that can create connections and run actions across external apps. Treat it as a secret.

Technical Analysis

The skill instructs the agent to construct every API destination from the environment-controlled MEMBRANE_API_URL value and attach MEMBRANE_TOKEN as a bearer credential. It does not require the configured URL to use HTTPS, validate that its hostname belongs to Membrane, or define an allowlist of trusted origins.

As a result, anyone able to influence the skill's environment can redirect authenticated requests to an arbitrary endpoint, including an attacker-controlled HTTPS server or a plaintext HTTP endpoint. The attacker-controlled server would receive the ` ...[truncated 2335 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove MEMBRANE_API_URL configurability when custom deployments are not an explicit requirement. Use a fixed, trusted API origin such as https://api.getmembrane.com.
2. If endpoint overrides are required, validate the URL before sending any request:
   • Require the https scheme.
   • Require an exact hostname from an explicit allowlist.
   • Reject embedded user information, unexpected ports, IP-literal hosts, and ambiguous hostnames.
   • Normalize the URL before applying validation.
3. Disable automatic redirects for authenticated requests, or strip the Authorization header whenever a redirect changes the origin. Reject redirects to non-HTTPS destinations.
4. Apply certificate and hostname verification using a maintained TLS implementation. Do not permit insecure certificate-verification overrides.
5. Scope MEMBRANE_TOKEN to the minimum required connections and operations. Use short-lived credentials and provide token rotation and immediate revocation procedures.
6. Avoid logging authorization headers, connection parameters, prompts, action inputs, or action outputs. Redact secrets from diagnostic messages.
7. Update the security documentation so the HTTPS claim reflects enforced behavior rather than only the default configuration.
8. Add tests that reject malicious endpoint values, including http:// URLs, untrusted domains, credential-bearing URLs, deceptive subdomains, and cross-origin redirects.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description is extremely broad ('connect to any external app' and 'perform any API operation'), making it likely to be invoked for a wide range of ordinary user requests that involve outside services. Because this skill holds a high-privilege Membrane token and can create connections, discover actions, and execute operations across many third-party apps, overbroad routing materially increases the chance of unnecessary external data transfer or unintended privileged actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.