Docraptor
PassAudited by ClawScan on May 1, 2026.
Overview
The skill is a coherent DocRaptor integration, but users should notice that it requires Membrane authentication, installs a global CLI, and can make authenticated DocRaptor API requests.
This appears suitable for users who want a Membrane-based DocRaptor integration. Before installing, make sure you trust the Membrane CLI, understand that authentication may persist, and confirm any document-creation, download, expiration, or direct API request before allowing the agent to run it.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A global CLI install can run code on the user's machine and will track whatever version is current at install time.
The skill asks the user to install a third-party CLI globally from npm using the moving latest tag.
npm install -g @membranehq/cli@latest
Install only if you trust Membrane's CLI package; consider pinning a known version or reviewing the package source before installation.
Once connected, the agent can use the authorized DocRaptor connection through Membrane for actions the account permits.
The integration relies on authenticated Membrane/DocRaptor access and credential refresh, which is expected for this service but important for users to understand.
Membrane handles authentication and credentials refresh automatically
Use an account or connection with only the permissions needed, and disconnect or revoke access when you no longer want the agent to use it.
Direct API requests may perform broader reads or writes than the listed convenience actions if the user or agent supplies such requests.
The skill documents a raw authenticated API escape hatch in addition to predefined actions.
When the available actions don't cover your use case, you can send requests directly to the DocRaptor API through Membrane's proxy.
Prefer listed actions when possible, and require clear user confirmation before direct API calls that create, expire, or otherwise change documents.
Document requests and related API data may pass through Membrane and DocRaptor rather than staying local.
DocRaptor API traffic is routed through Membrane as an authenticated proxy/gateway, which is disclosed and aligned with the integration.
Membrane's proxy ... injects the correct authentication headers
Avoid sending document content or URLs containing sensitive data unless you are comfortable with Membrane and DocRaptor processing that data.