Okta
Security checks across malware telemetry and agentic risk
Overview
This Okta skill appears purpose-aligned, but it can mediate sensitive Okta credentials and perform high-impact identity-management actions, including permanent deletions, without documenting clear scope or confirmation safeguards.
Only install this if you trust Membrane and intend to let an agent manage Okta. Use a least-privileged Okta account, verify the granted scopes, and require explicit human approval before any user, group, application, activation, deactivation, or deletion changes.
VirusTotal
63/63 vendors flagged this skill as clean.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If used with an Okta account that has sufficient permissions, the agent could make irreversible identity and access-management changes.
The skill documents broad Okta mutation capabilities, including permanent user deletion, but the provided instructions do not include confirmation or safety boundaries for these high-impact actions.
| Delete User | delete-user | Deletes a user permanently from the Okta organization. | ... | Create User | create-user | ... | Update User | update-user | ... | Remove User from Group | remove-user-from-group |
Use least-privileged Okta access, require explicit human confirmation for create/update/delete/deactivate actions, and test against non-production tenants where possible.
The connection may inherit broad Okta authority from the authenticating user, potentially affecting users, groups, and applications across the organization.
The integration depends on delegated Okta authentication through Membrane and automatic credential refresh, but the artifacts do not specify required Okta scopes, admin roles, or privilege limits.
Membrane handles authentication and credentials refresh automatically ... The user completes authentication in the browser. The output contains the new connection id.
Authenticate with a narrowly scoped service account or admin role, review the Okta scopes granted during connection, and document exactly what permissions the skill requires.
The installed CLI code may change over time and was not included in the skill artifact review.
The setup relies on installing the latest version of an external global npm CLI, which is expected for this Membrane integration but is not pinned in the reviewed artifact.
npm install -g @membranehq/cli@latest
Install from a trusted npm source, consider pinning a reviewed CLI version, and follow the Membrane CLI security guidance.
Okta identity-management operations and related data may be handled through a third-party integration provider.
Okta authentication and action execution are mediated through the Membrane CLI/service, which is purpose-aligned but creates an external provider data boundary users should understand.
This skill uses the Membrane CLI to interact with Okta. Membrane handles authentication and credentials refresh automatically
Review Membrane's data handling, tenant isolation, and credential storage practices before connecting a production Okta tenant.