Aerisweather
Analysis
This looks like a plausible AerisWeather integration, but it asks the agent/user to install and run an unpinned global Membrane CLI outside the declared install metadata.
Findings (7)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
`clientAction.agentInstructions` (optional) — instructions for the AI agent on how to proceed programmatically.
The skill allows instructions returned by the Membrane connection flow to guide the agent. That can be useful for setup, but these external instructions should not override the user's goal or higher-priority instructions.
`membrane action list --connectionId=CONNECTION_ID --intent "QUERY" --limit 10 --json` ... `membrane action run <actionId> --connectionId=CONNECTION_ID --json`
The skill uses dynamic action discovery and execution through a CLI. This is aligned with an integration skill, but action execution is broad and the instructions do not explicitly require user confirmation before running discovered actions.
npm install -g @membranehq/cli@latest
The skill instructs users to install a global npm package at @latest. This is unpinned and not represented in the provided install spec, creating a supply-chain and provenance gap.
npx @membranehq/cli connection get <id> --wait --json
The runtime instructions invoke an npm-hosted CLI through npx, which can execute external package code as part of normal use. This code execution path is not captured by the skill's no-install-spec metadata.
If no app is found, one is created and a connector is built automatically.
A mistaken URL/domain or setup flow can create a persistent Membrane app/connector. This is part of the intended workflow, but it means setup mistakes may persist beyond the immediate task.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
Membrane handles authentication and credentials refresh automatically — so you can focus on the integration logic rather than auth plumbing.
The skill uses delegated authentication and automatic credential refresh. This is disclosed and relevant to the AerisWeather integration, but it means persistent account access may be granted through Membrane.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
`clientAction.agentInstructions` (optional) — instructions for the AI agent on how to proceed programmatically.
The skill may place service-provided instructions into the agent's working context. This is useful for setup, but retrieved instructions can be over-trusted if not treated as untrusted operational data.