v1.0.4

Kustomer

SuspiciousClawScan verdict for this skill. Analyzed Apr 30, 2026, 5:06 PM.

Analysis

This Kustomer skill is purpose-aligned, but it grants broad CRM access and asks the agent to install and run an unpinned external CLI with limited approval or containment guidance.

GuidanceInstall only if you trust Membrane and the npm CLI source, prefer a pinned CLI version, connect a least-privileged Kustomer account, and require explicit confirmation before the agent creates, updates, or otherwise changes CRM records.

Findings (8)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agent Goal Hijack

SeverityLowConfidenceHighStatusNote

SKILL.md

`clientAction.agentInstructions` (optional) — instructions for the AI agent on how to proceed programmatically.

The skill tells the agent that external connection responses may contain instructions for the AI agent. This is purpose-aligned for setup, but those instructions should not be allowed to override the user’s request or safety boundaries.

User impactA connection response could influence how the agent proceeds during setup or action selection.

RecommendationTreat returned agent instructions as untrusted operational hints and follow them only when they match the user’s explicit request.

Tool Misuse and Exploitation

SeverityHighConfidenceHighStatusConcern

SKILL.md

Use action names and parameters as needed. ... Create Customer ... Create Conversation ... Create Message ... Update Customer

The skill authorizes broad use of discovered Kustomer actions, including persistent write operations, but does not define approval, scoping, or rollback requirements for high-impact changes.

User impactThe agent could create or modify Kustomer customer, conversation, message, company, or note records if prompted or if it misinterprets a request.

RecommendationRequire explicit user confirmation before any create, update, bulk, or customer-visible action, and restrict actions to the specific records named by the user.

Agentic Supply Chain Vulnerabilities

SeverityMediumConfidenceHighStatusConcern

SKILL.md

npm install -g @membranehq/cli@latest ... If no app is found, one is created and a connector is built automatically.

The skill relies on an unpinned global npm package and may create an automatically built connector that is not included in the reviewed artifacts.

User impactThe behavior depends on external package and connector code that can change outside this skill review.

RecommendationPin the CLI version, verify the package source, and review any generated connector before using it for sensitive Kustomer data.

Unexpected Code Execution

SeverityMediumConfidenceHighStatusConcern

SKILL.md

npm install -g @membranehq/cli@latest ... npx @membranehq/cli connection get <id> --wait --json

Although this is presented as an instruction-only skill, it instructs the user or agent to install and execute npm-distributed CLI code.

User impactInstalling or running the CLI executes code from an external npm package on the local environment.

RecommendationInstall the CLI only from a trusted source, prefer a pinned version, and avoid running it in highly privileged local environments.

Cascading Failures

SeverityMediumConfidenceHighStatusConcern

SKILL.md

List Customers — Retrieves all customers in your organization ... Update Customer — Updates an existing customer's attributes in Kustomer

The actions can operate on organization-wide Kustomer data and make persistent changes, but the skill does not provide containment rules for mistaken bulk or cross-record operations.

User impactA mistaken action could affect shared CRM records used by support or customer-success teams.

RecommendationLimit requests to specific records, avoid bulk changes unless explicitly reviewed, and confirm every persistent modification before execution.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

Membrane handles authentication and credentials refresh automatically ... The user completes authentication in the browser.

The skill requires delegated account authentication and credential refresh through Membrane/Kustomer. This is expected for the stated integration, but it gives the connected account’s privileges to the workflow.

User impactThe integration can act with the permissions of the connected Membrane/Kustomer account.

RecommendationConnect only a least-privileged account and verify what Kustomer permissions the connection receives.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityLowConfidenceMediumStatusNote

SKILL.md

Each result includes `id`, `name`, `description`, `inputSchema` ... and `outputSchema`.

The agent is expected to use retrieved action metadata to decide which actions and parameters to use. This is normal for the integration, but retrieved descriptions and schemas should be treated as external context, not higher-priority instructions.

User impactIncorrect or misleading action metadata could cause the agent to choose the wrong Kustomer operation or parameters.

RecommendationUse retrieved schemas only to format tool calls, and verify intended record IDs and write operations with the user.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

This skill uses the Membrane CLI to interact with Kustomer. Membrane handles authentication and credentials refresh automatically.

Kustomer access is mediated through the Membrane service/CLI, creating a third-party gateway for authentication and CRM operations. This is disclosed and purpose-aligned, but sensitive data and permissions flow through that provider.

User impactCustomer-service data and account permissions may be handled through Membrane as part of the integration.

RecommendationUse this only if you trust Membrane with the relevant Kustomer access and confirm that the connected account has appropriate permissions.