Back to skill
Skillv1.0.3
ClawScan security
Cloudtalk · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 21, 2026, 6:03 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requested actions and dependencies align with its stated purpose: it instructs the agent to use the Membrane CLI to interact with CloudTalk and doesn't ask for unrelated credentials or broad system access.
- Guidance
- This skill is coherent: it uses the Membrane CLI to manage CloudTalk resources and does not request unrelated credentials. Before installing: (1) verify the Membrane CLI package and publisher (@membranehq) on npm and the linked GitHub repo/homepage; (2) be aware that `npm install -g` installs a globally-executed package — only install trusted CLIs; (3) you will need a Membrane account and network access; (4) the skill relies on Membrane to hold CloudTalk credentials server-side (you shouldn't need to paste API keys into the agent). If you want extra assurance, review the Membrane CLI source on the repository linked in the SKILL.md before installing.
Review Dimensions
- Purpose & Capability
- okName/description (CloudTalk integration) match the instructions: all runtime steps call the Membrane CLI to connect to CloudTalk, discover actions, and run them. Asking for a Membrane account and network access is proportionate.
- Instruction Scope
- okSKILL.md restricts itself to installing and using the Membrane CLI, authenticating via browser/authorization URL, creating connections, listing actions, and running them. It does not instruct reading arbitrary files, pulling unrelated environment variables, or exfiltrating data to unexpected endpoints.
- Install Mechanism
- noteThis is an instruction-only skill (no install spec) but tells the user to run `npm install -g @membranehq/cli@latest`. Installing a global npm package is a normal step for CLI usage but is performed outside the registry install framework; users should verify the package source before installing. No obscure download URLs or archive extraction are used in the instructions.
- Credentials
- okThe skill declares no required environment variables or credentials and explicitly recommends using Membrane-managed connections instead of asking users for API keys. This is proportionate to the integration task.
- Persistence & Privilege
- okThe skill is not always-enabled (always: false) and is user-invocable. It does not request persistent system-wide configuration or access to other skills' credentials.