v1.0.4

Replyio

ReviewClawScan verdict for this skill. Analyzed Apr 30, 2026, 5:35 PM.

Analysis

This looks like a real Reply.io integration, but it gives the agent broad credentialed API power and asks it to install unpinned remote CLI code without clear safety limits.

GuidanceInstall only if you trust Membrane and need Reply.io automation. Prefer a least-privileged Reply.io account, pin or preinstall the Membrane CLI instead of using @latest, and require explicit confirmation before the agent creates, updates, deletes, or bulk-modifies Reply.io data.

Findings (9)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agent Goal Hijack

SeverityLowConfidenceMediumStatusNote

SKILL.md

`clientAction.agentInstructions` (optional) — instructions for the AI agent on how to proceed programmatically.

The skill allows dynamic instructions returned by the external connection flow to guide the agent. This is purpose-aligned for setup, but it gives retrieved content some authority over next steps.

User impactThe agent may follow setup instructions supplied through Membrane during connection handling.

RecommendationTreat dynamic connection instructions as limited to authentication/setup and do not let them override the user's actual task or safety limits.

Tool Misuse and Exploitation

SeverityHighConfidenceHighStatusConcern

SKILL.md

Proxy requests... `-X, --method` | HTTP method (GET, POST, PUT, PATCH, DELETE).

The skill authorizes direct authenticated API proxy calls, including mutating and deleting methods, without artifact-level approval, endpoint, record, or bulk-operation limits.

User impactA mistaken or overly broad request could change or delete Reply.io business data such as leads, activities, notes, files, or related resources.

RecommendationRequire explicit user confirmation for create/update/delete or bulk actions, restrict allowed endpoints/actions, and prefer read-only discovery before mutations.

Agentic Supply Chain Vulnerabilities

SeverityMediumConfidenceHighStatusConcern

SKILL.md

npm install -g @membranehq/cli@latest

The skill instructs installation of a globally available npm package using the moving `@latest` tag, so the installed code is not pinned to a reviewed version.

User impactA future or compromised npm release could change what code runs on the user's machine or agent environment.

RecommendationPin the CLI to a specific reviewed version, avoid global installs where possible, and document the dependency in an install spec.

Unexpected Code Execution

SeverityMediumConfidenceHighStatusConcern

SKILL.md

Use `npx @membranehq/cli@latest action list --intent=QUERY --connectionId=CONNECTION_ID --json`

The instruction-only skill tells the agent to execute remote npm CLI code via `npx @latest`, which can download and run code outside the reviewed artifact set.

User impactInstalling or running the skill may execute code that was not included in the submitted skill files.

RecommendationUse a pinned, preinstalled, reviewed CLI binary and avoid `npx @latest` execution for security-sensitive integrations.

Cascading Failures

SeverityMediumConfidenceHighStatusConcern

SKILL.md

Manage Persons, Organizations, Leads, Activities, Notes, Files and more.

The skill can operate across multiple categories of Reply.io business data, and the artifacts do not describe containment such as dry-run mode, batch limits, rollback, or approval gates.

User impactA wrong instruction or parameter could affect multiple records or workflows in the connected Reply.io account.

RecommendationStart with read-only/list actions, confirm exact target records before changes, and require user approval for bulk or destructive operations.

Human-Agent Trust Exploitation

SeverityLowConfidenceMediumStatusNote

SKILL.md

Membrane provides pre-built actions with built-in auth, pagination, and error handling... make communication more secure

The skill makes a general security-benefit claim about using Membrane. It may be true, but the artifacts do not substantiate the claim or balance it against the broad proxy and credentialed access.

User impactUsers may over-trust the integration's safety because of broad wording about security.

RecommendationTreat the security claim as a provider assertion and still review permissions, scopes, and requested actions carefully.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityMediumConfidenceHighStatusConcern

SKILL.md

Membrane handles authentication and credentials refresh automatically

The skill relies on delegated account access with automatic credential refresh, but the artifacts do not state the exact scopes, duration, revocation process, or boundaries for the Reply.io connection.

User impactConnecting an account may grant continuing authority to act on Reply.io data through Membrane beyond a single prompt.

RecommendationUse the least-privileged Reply.io account available, review granted scopes in Membrane/Reply.io, and revoke the connection when no longer needed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityLowConfidenceMediumStatusNote

SKILL.md

Use `membrane connection ensure` to find or create a connection... The output contains the new connection id.

The skill creates or reuses a persistent connection identifier that can be referenced across future commands. This is expected for an integration, but it is persistent sensitive context.

User impactA saved connection may allow later tasks to reuse the same authenticated Reply.io access.

RecommendationTrack which connection is being used, avoid sharing connection IDs unnecessarily, and revoke unused connections.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

send requests directly to the Reply.io API through Membrane's proxy... injects the correct authentication headers

The integration uses Membrane as a gateway/proxy for Reply.io API traffic and authentication headers. This is disclosed and purpose-aligned, but it means sensitive traffic is brokered through a third party.

User impactReply.io request data and authentication handling may pass through Membrane infrastructure.

RecommendationReview Membrane's security and data-handling terms before connecting sensitive Reply.io accounts.