Back to skill
Skillv1.0.3
ClawScan security
Happy Scribe · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 21, 2026, 7:07 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent: it delegates Happy Scribe access to the Membrane CLI, requests no unrelated credentials or file access, and is instruction-only with a standard npm-based install path.
- Guidance
- This skill delegates all work to the Membrane CLI and asks you to install @membranehq/cli and sign in to your Membrane account, then create a Happy Scribe connection. Before installing: verify you trust the Membrane service (privacy, data handling, and access scopes), confirm the npm package name (@membranehq/cli) and its source on npm/GitHub, and avoid running CLI commands with elevated privileges. When connecting, review what access the connector requests for your Happy Scribe account. Because the skill is instruction-only and requests no local secrets, the main risk is granting network/API access to third-party services — proceed only if you trust Membrane and Happy Scribe.
Review Dimensions
- Purpose & Capability
- okThe name/description (Happy Scribe integration) match the instructions: all actions are performed via the Membrane CLI and focus on listing/creating/transcribing/exporting tasks for Happy Scribe. No unrelated services, credentials, or system resources are requested.
- Instruction Scope
- okSKILL.md only instructs installing and using the Membrane CLI, performing login and creating/listing connections and actions. It does not instruct reading arbitrary files, environment variables, or sending data to unexpected endpoints beyond the Membrane service and Happy Scribe connectors.
- Install Mechanism
- noteInstaller is an npm global install (npm install -g @membranehq/cli@latest). This is a common approach but does write a global binary and requires trust in the @membranehq package on npm. No downloads from untrusted URLs or archive extraction are present.
- Credentials
- okThe skill declares no required env vars or credentials and instructs users to rely on Membrane for auth. Requested permissions are proportional to its purpose; users will grant access to their Happy Scribe account during the connect/login flow.
- Persistence & Privilege
- okalways is false and there are no config paths or requests to modify other skills or system settings. The skill can be invoked autonomously (platform default), which is expected for integrations that perform API actions; this is not a standalone concern here.