v1.0.4

Corsizio

SuspiciousClawScan verdict for this skill. Analyzed Apr 30, 2026, 4:36 PM.

Analysis

The skill matches its Corsizio purpose, but it asks the agent to install and use a mutable third-party CLI with broad authenticated access to manage live Corsizio data.

GuidanceInstall only if you are comfortable granting Membrane-mediated authenticated access to Corsizio. Pin or verify the Membrane CLI before installing it, prefer a least-privilege or test account, and require explicit confirmation before any action that changes events, attendees, orders, coupons, payments, or account settings.

Findings (8)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agent Goal Hijack

SeverityLowConfidenceHighStatusNote

SKILL.md

`clientAction.agentInstructions` (optional) — instructions for the AI agent on how to proceed programmatically.

The skill allows retrieved connection-state content to provide instructions to the agent. This is purpose-aligned for setup, but the agent should treat it as untrusted operational data, not as authority over the user's request.

User impactA connection response could influence what the agent does during setup if the agent follows those instructions too broadly.

RecommendationOnly follow external agent instructions when they are consistent with the user's request and higher-priority system/developer instructions.

Tool Misuse and Exploitation

SeverityHighConfidenceHighStatusConcern

SKILL.md

membrane action run <actionId> --connectionId=CONNECTION_ID --input '{"key": "value"}' --json ... `-X, --method` | HTTP method (GET, POST, PUT, PATCH, DELETE).

The skill permits arbitrary discovered Corsizio actions and direct authenticated proxy requests, including mutating HTTP methods, without stated confirmation, dry-run, or scope restrictions.

User impactThe agent could change or delete live Corsizio events, participant records, orders, coupons, or other account data if invoked incorrectly.

RecommendationRequire explicit user confirmation for any POST, PUT, PATCH, DELETE, payment/order, coupon, attendee, or account-changing action; prefer read-only actions unless the user clearly requests a change.

Agentic Supply Chain Vulnerabilities

SeverityMediumConfidenceHighStatusConcern

SKILL.md

npm install -g @membranehq/cli@latest

The skill instructs a global npm installation using the mutable `@latest` tag, while the package version and install behavior are not pinned in an install spec.

User impactA future or compromised npm release could execute different code than the reviewed artifact implies.

RecommendationPin the CLI to a reviewed version, avoid global installs when possible, and verify the package source before installation.

Unexpected Code Execution

SeverityMediumConfidenceHighStatusNote

SKILL.md

Install the Membrane CLI so you can run `membrane` from the terminal: `npm install -g @membranehq/cli@latest`

Installing and running an npm CLI executes local code. This is disclosed and aligned with the integration purpose, but it is still local code execution outside the instruction-only artifact.

User impactUsing the skill may run third-party CLI code on the user's machine or agent environment.

RecommendationInstall only in a trusted environment and review the CLI package before running it with account credentials.

Cascading Failures

SeverityHighConfidenceHighStatusConcern

SKILL.md

Corsizio is a platform for selling and managing classes, workshops, and events online ... handle registration, payments, and communication with attendees.

The skill operates on live operational data involving registrations, payments, and attendee communications; combined with mutating proxy/action capabilities, a mistaken action can propagate to real users and business records.

User impactAn incorrect command could affect public events, attendee communications, registrations, orders, or payment-related records.

RecommendationUse test accounts where possible, export or back up important data first, and require step-by-step confirmation before production mutations.

Human-Agent Trust Exploitation

SeverityLowConfidenceMediumStatusNote

metadata

Primary credential: none

The registry-facing requirements can make the skill look credential-free, while SKILL.md later requires Membrane login and authenticated Corsizio connection setup. The skill does disclose authentication in its instructions, so this is a note rather than a deceptive-content concern.

User impactUsers may underestimate the account authorization needed before reading the detailed setup instructions.

RecommendationTreat this as a credentialed integration and review the authentication flow before installing or invoking it.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityHighConfidenceHighStatusConcern

SKILL.md

Membrane handles authentication and credentials refresh automatically ... injects the correct authentication headers — including transparent credential refresh if they expire.

The skill delegates authenticated Corsizio access and credential refresh to Membrane, but the artifacts do not clearly define least-privilege scope, retention, revocation, or approval boundaries for the resulting account authority.

User impactConnecting an account can give the tool continuing authenticated access to sensitive Corsizio data and account-changing operations.

RecommendationUse a dedicated least-privilege account where possible, review requested connection permissions, and revoke the Membrane/Corsizio connection when it is no longer needed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityMediumConfidenceHighStatusNote

SKILL.md

send requests directly to the Corsizio API through Membrane's proxy ... injects the correct authentication headers

Corsizio API traffic and authenticated requests are routed through Membrane as a gateway. This is disclosed and purpose-aligned, but users should understand the intermediary and data boundary.

User impactSensitive Corsizio information, such as attendee, account, order, or payment-related data, may pass through Membrane during use.

RecommendationReview Membrane's trust, privacy, and permission model before connecting production Corsizio data, and avoid sending unnecessary sensitive fields.