v1.0.4

Moneybird

SuspiciousClawScan verdict for this skill. Analyzed Apr 30, 2026, 5:17 PM.

Analysis

The skill appears to be a real Moneybird connector, but it asks for persistent accounting-account access and unpinned external CLI execution while giving the agent broad financial write actions without clear approval limits.

GuidanceInstall only if you trust Membrane and the npm CLI package, can use a least-privileged Moneybird account, and are prepared to manually approve every financial write action such as creating or updating invoices, contacts, products, payments, purchases, or mutations.

Findings (8)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agent Goal Hijack

SeverityLowConfidenceHighStatusNote

SKILL.md

`clientAction.agentInstructions` (optional) — instructions for the AI agent on how to proceed programmatically.

The skill allows instructions returned by an external connection flow to guide the agent. This is purpose-aligned for setup, but those instructions should not override the user's request or safety checks.

User impactA connection response could influence what the agent does next during setup.

RecommendationTreat returned agent instructions as operational hints only, and keep user intent and explicit approvals authoritative.

Tool Misuse and Exploitation

SeverityHighConfidenceHighStatusConcern

SKILL.md

Use action names and parameters as needed. ... Create Sales Invoice ... Create Contact ... Create Product ... Update Sales Invoice

The skill exposes broad Moneybird actions, including financial record creation and updates, without specifying approval gates, dry-runs, limits, or rollback procedures.

User impactThe agent could create or change accounting records if it misinterprets a request or uses the wrong parameters.

RecommendationRequire explicit user confirmation for every create, update, payment, invoice, purchase, or financial mutation action, including the target administration and exact parameters.

Agentic Supply Chain Vulnerabilities

SeverityMediumConfidenceHighStatusConcern

SKILL.md

npm install -g @membranehq/cli@latest

The skill instructs a global install of the latest version of an external npm package, which is unpinned and outside the provided install specification.

User impactA future changed or compromised npm package version could run on the user's machine during installation or use.

RecommendationPin the CLI to a reviewed version, avoid global installs where possible, and verify the package publisher and checksum before installation.

Unexpected Code Execution

SeverityLowConfidenceHighStatusNote

SKILL.md

npx @membranehq/cli connection get <id> --wait --json

The skill requires running an external CLI from the local terminal. This is consistent with the stated integration approach, but it is still local code execution users should notice.

User impactUsing the skill may execute third-party CLI code on the user's system.

RecommendationRun the CLI only from a trusted environment, prefer an installed pinned version over ad-hoc npx execution, and review commands before running them.

Cascading Failures

SeverityMediumConfidenceHighStatusConcern

SKILL.md

`List Administrations` ... all administrations the authenticated user has access to ... `Create Sales Invoice` ... Create a new sales invoice

The agent can operate across all accessible administrations and perform financial create/update actions, so a wrong administration ID or parameter could propagate into real cloud accounting records.

User impactA single mistaken action could affect invoices, products, contacts, or other accounting data in the wrong business administration.

RecommendationRequire the user to select the administration explicitly, confirm all write operations, and prefer read-only checks before making changes.

Human-Agent Trust Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

Membrane handles authentication and credentials refresh automatically — so you can focus on the integration logic rather than auth plumbing.

The wording frames credential handling as automatic and convenient. That is not inherently deceptive, but users should still understand that persistent credential handling is sensitive.

User impactUsers may pay less attention to the security implications of granting and refreshing accounting access.

RecommendationMake credential persistence, revocation steps, and permission scope clear before connection.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityHighConfidenceHighStatusConcern

SKILL.md

Membrane handles authentication and credentials refresh automatically ... List Administrations ... all administrations the authenticated user has access to

The skill relies on persistent delegated access to the user's Moneybird/Membrane account and can enumerate all accessible administrations, but does not describe least-privilege scopes or expiry.

User impactConnecting the skill may grant access across more accounting administrations or data than the user intended.

RecommendationUse a least-privileged Moneybird account, review OAuth scopes, restrict accessible administrations, and revoke the connection when no longer needed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityMediumConfidenceHighStatusNote

SKILL.md

Use `membrane connection ensure` to find or create a connection by app URL or domain ... If no app is found, one is created and a connector is built automatically.

The skill routes authentication and Moneybird operations through a Membrane gateway/connector flow. This is purpose-aligned, but connector origin, permissions, and financial data boundaries should be verified.

User impactSensitive accounting data and credentials may pass through or be managed by the Membrane connection layer.

RecommendationVerify the connection target, review Membrane and Moneybird permissions, and avoid proceeding with unexpected auto-created connectors.