Back to skill
Skillv1.0.1
ClawScan security
Firecrawl · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 22, 2026, 4:04 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's instructions, requirements, and behavior are coherent with a Membrane/Firecrawl CLI integration and do not request disproportionate privileges or unrelated credentials.
- Guidance
- This skill is an instruction-only integration that expects you to use the Membrane CLI to connect to Firecrawl. Before installing or following the steps: (1) confirm the legitimacy of the @membranehq/cli npm package and the GitHub repo cited in the docs; (2) understand that installing a global npm package runs third-party code on your machine—only install packages you trust; (3) the workflow requires interactive login that grants Membrane-managed access to the connected service, so review Membrane's privacy/auth docs and the permissions you grant during the browser-based login; (4) do not paste API keys or secrets into the chat—use the CLI's connection flow as documented. If you want higher assurance, inspect the npm package source or the repository before installing.
Review Dimensions
- Purpose & Capability
- okThe name/description describe a Firecrawl integration and every runtime instruction refers to the Membrane CLI and Firecrawl connector. Requiring network access and a Membrane account matches the stated purpose; no unrelated credentials or services are requested.
- Instruction Scope
- okSKILL.md gives step-by-step CLI usage (install CLI, login, connect, list/discover/create/run actions). It does not instruct the agent to read unrelated files, exfiltrate data, or access environment variables beyond standard interactive login flows. It explicitly advises against asking users for API keys.
- Install Mechanism
- noteThere is no automated install spec in the skill bundle (instruction-only). The doc recommends installing @membranehq/cli via npm -g or using npx; this is reasonable for a CLI but does mean the user would install a global npm package that runs code on their system. Users should verify the npm package and GitHub repo before installing.
- Credentials
- okThe skill declares no required environment variables or credentials and relies on Membrane to manage auth. That is proportionate to a connector-based integration. Users should still be aware that completing an interactive login grants Membrane access to the connected systems per its auth model.
- Persistence & Privilege
- okalways is false, the skill is user-invocable and does not request permanent presence or modification of other skills or system-wide settings. There is no instruction to change agent/global configuration beyond authenticating the CLI.