v1.0.2

Logoraisr

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:20 AM.

Analysis

This is a disclosed Membrane-based Logoraisr integration, but it requires installing a CLI, logging into Membrane, and can make credentialed Logoraisr API requests.

GuidanceBefore installing, confirm you trust the Membrane CLI source, log in with an account that has only the permissions needed, and require explicit approval for any Logoraisr action that changes or deletes data.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

When the available actions don't cover your use case, you can send requests directly to the Logoraisr API through Membrane's proxy... `-X, --method` | HTTP method (GET, POST, PUT, PATCH, DELETE).

The skill documents a broad authenticated API proxy that can use mutating or deleting HTTP methods. This is disclosed and aligned with an integration skill, but it expands the range of actions beyond prebuilt scoped workflows.

User impactIf used carelessly, the agent could change or delete Logoraisr data through authenticated API calls.

RecommendationApprove specific mutating or deleting requests before they are run, and prefer prebuilt Membrane actions when available.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

SKILL.md

`npm install -g @membranehq/cli` and `npx @membranehq/cli@latest action list --intent=QUERY --connectionId=CONNECTION_ID --json`

The skill depends on an external npm CLI, including a global install and an @latest invocation. This is purpose-aligned, but it is not pinned by the skill artifacts.

User impactInstalling or running the CLI pulls code from the npm package source, so package integrity and version changes matter.

RecommendationInstall the Membrane CLI from the official package source, consider pinning a known version, and avoid running unexpected package prompts.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

This skill uses the Membrane CLI to interact with Logoraisr. Membrane handles authentication and credentials refresh automatically... `membrane login --tenant`.

The skill requires a Membrane login and delegated Logoraisr connection. That credentialed access is expected for the integration, but it is still account authority the user should understand.

User impactThe skill can act with whatever permissions the connected Membrane/Logoraisr account provides.

RecommendationUse the least-privileged account or connection available and review which Logoraisr workspace or organization is connected.