Nationbuilder
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill appears to be a real NationBuilder integration, but it gives the agent broad OAuth-backed ability to affect sensitive campaign, fundraising, communication, and financial records without clear visible safeguards for high-impact changes.
Install only if you are comfortable giving Membrane-connected tooling access to your NationBuilder account. Use a limited-permission account, tell the agent to ask before any write, bulk, communication, impersonation, or financial action, and consider pinning the Membrane CLI version.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If the agent chooses the wrong action or parameters, it could change sensitive supporter, campaign, communication, or financial records in the connected NationBuilder account.
The skill exposes a broad action surface over high-impact NationBuilder objects, including communications, fundraising/financial records, impersonation, and OAuth-related resources, but the provided instructions do not visibly require confirmation or constrain write actions.
Manage Persons, Organizations, Deals, Activities, Notes, Files and more ... Donation ... Broadcast ... SMS Message ... User Impersonation ... Oauth Application ... Transaction ... Quickbooks Payment ... Use action names and parameters as needed.
Use least-privilege access and require explicit user confirmation before any create, update, delete, send, payment, import, impersonation, or bulk action.
The connected account’s permissions determine what the agent can read or change in NationBuilder.
The skill requires delegated Membrane/NationBuilder authentication and persistent credential refresh. This is expected for the integration, but it grants the agent authority within the connected tenant.
Membrane handles authentication and credentials refresh automatically ... membrane login --tenant --clientName=<agentType> ... The user completes authentication in the browser.
Authenticate with a least-privilege account, review OAuth scopes and tenant selection, and revoke the Membrane/NationBuilder connection when it is no longer needed.
A future CLI version or compromised package distribution could change what code is installed and run locally.
The installation step uses a global npm package with the floating @latest version. This is a normal CLI setup pattern for this purpose, but it is not pinned to a reviewed version.
npm install -g @membranehq/cli@latest
Install from a trusted environment, consider pinning a known CLI version, and review the package provenance before granting it account access.