Back to skill
Skillv1.0.1
ClawScan security
Officient · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 22, 2026, 11:10 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is an instruction-only Officient integration that consistently instructs the agent to use the Membrane CLI; the steps and requirements align with the stated purpose, but installing a third‑party npm CLI and routing Officient data through Membrane are vendor-decisions you should verify before proceeding.
- Guidance
- This skill is coherent with its stated purpose: it simply tells the agent to use the Membrane CLI to connect to Officient. Before installing or using it, verify the Membrane vendor (npm package @membranehq/cli and GitHub repo), check the CLI's npm page and source for legitimacy, and read Membrane's privacy/data policy so you understand where Officient data and auth tokens will be stored and processed. Prefer using npx for one-off calls rather than a global npm -g install in sensitive environments. If possible, limit the privileges of the Membrane/Officient account you use (avoid using an org-wide admin token), and review the OAuth/consent scopes presented during the membrane login flow. Finally, be aware that the agent may invoke this skill when asked or when eligible — consider whether you want automated actions against Officient data and adjust agent permissions/policies accordingly.
Review Dimensions
- Purpose & Capability
- okThe skill is described as an Officient integration and all runtime instructions are about using the Membrane CLI to connect to Officient, discover and run actions. There are no unrelated requirements (no AWS creds, no unrelated binaries) that would be out of scope.
- Instruction Scope
- okSKILL.md only instructs the agent to install and use the Membrane CLI to authenticate, create connections, discover actions, build actions if needed, and run them. It does not instruct reading local system files, unrelated environment variables, or sending data to endpoints outside the Membrane/Officient flow. The doc explicitly advises against asking users for API keys and to let Membrane handle auth.
- Install Mechanism
- noteNo embedded install spec in the skill bundle (instruction-only), but the SKILL.md directs installing @membranehq/cli via npm (global install or npx). Installing a third-party npm CLI is a reasonable and expected way to interact with a service, but npm installs execute remote package code and modify the host environment — verify the package publisher, npm page, and source repository before installing, or prefer npx to avoid persistent global installs.
- Credentials
- okThe skill requests no environment variables or local config paths. Authentication is handled by Membrane via interactive login/authorization flow, which is proportional to the stated purpose. That said, trusting Membrane with credentials/data is a policy decision for the user/organization.
- Persistence & Privilege
- okThe skill is not marked always:true and is user-invocable. There is no instruction to modify other skills or global agent settings. Autonomous invocation is allowed by platform default (not flagged here) and should be considered by users when granting permissions.