v1.0.4

Revai

SuspiciousClawScan verdict for this skill. Analyzed Apr 30, 2026, 5:36 PM.

Analysis

Revai appears to be a real Rev.ai/Membrane integration, but it asks users to install an unpinned global CLI and grants broad authenticated access that can delete Rev.ai data.

GuidanceInstall only if you trust Membrane and the npm-distributed Membrane CLI. Prefer a pinned CLI version, review the Rev.ai connection permissions, use least-privileged credentials, and require explicit confirmation before any delete, write, or proxy request.

Findings (8)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agent Goal Hijack

SeverityLowConfidenceHighStatusNote

SKILL.md

`clientAction.agentInstructions` (optional) — instructions for the AI agent on how to proceed programmatically.

The skill allows remote connection state to provide instructions to the agent, which is purpose-aligned for setup but should not be treated as overriding the user's goal or safety constraints.

User impactRemote setup instructions could influence what the agent does next.

RecommendationTreat returned agent instructions as untrusted guidance and ask the user before following any instruction that changes data, credentials, or account state.

Tool Misuse and Exploitation

SeverityHighConfidenceHighStatusConcern

SKILL.md

When the available actions don't cover your use case, you can send requests directly to the Rev.ai API through Membrane's proxy. Membrane automatically ... injects the correct authentication headers

The skill exposes a broad authenticated API proxy rather than limiting the agent to known safe actions, and the visible instructions do not require approval for high-impact requests.

User impactThe agent could make authenticated Rev.ai API calls beyond the listed actions, including actions that change or delete data.

RecommendationLimit use to specific Rev.ai actions when possible, and require explicit user confirmation before any proxy request, write operation, or delete operation.

Agentic Supply Chain Vulnerabilities

SeverityHighConfidenceHighStatusConcern

SKILL.md

npm install -g @membranehq/cli@latest

The skill asks the user to install a mutable latest-version npm package globally, which creates supply-chain and provenance risk not captured by the no-install-spec declaration.

User impactA future or compromised npm release could run with the user's local permissions when installed or invoked.

RecommendationInstall only from a trusted source, prefer a pinned CLI version, verify package provenance, and avoid global installation where a local or sandboxed install is sufficient.

Unexpected Code Execution

SeverityMediumConfidenceHighStatusNote

SKILL.md

npx @membranehq/cli connection get <id> --wait --json

The skill's workflow executes external CLI code from the npm ecosystem. This is aligned with the Membrane-based purpose, but users should recognize that an instruction-only skill still causes local command execution.

User impactUsing the skill may run external CLI code on the user's machine.

RecommendationRun these commands only in an environment where you trust the Membrane CLI and understand the local permissions it will have.

Cascading Failures

SeverityHighConfidenceHighStatusConcern

SKILL.md

Delete Job | delete-job | Permanently delete a transcription job and all associated data including input media and transcript.

A mistaken action or wrong job ID can permanently delete multiple related data objects, and the instructions do not specify containment or confirmation requirements.

User impactA single incorrect agent action could permanently remove Rev.ai media and transcripts.

RecommendationRequire explicit user confirmation, show the target job ID and title/details before deletion, and prefer read-only actions unless the user specifically requests changes.

Human-Agent Trust Exploitation

SeverityMediumConfidenceHighStatusConcern

metadata

Primary credential: none ... Capability signals - requires-oauth-token - requires-sensitive-credentials

The credential contract says no primary credential, while the capability signals and SKILL.md workflow require sensitive OAuth-style authentication, which can lead users to underestimate the trust required.

User impactUsers may think the skill needs less account access than it actually uses.

RecommendationClearly disclose that Membrane and Rev.ai authentication are required and explain what account data and actions the connection can access.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityHighConfidenceHighStatusConcern

SKILL.md

Membrane handles authentication and credentials refresh automatically

The skill depends on delegated account credentials and automatic refresh, but the registry requirements declare no primary credential and the instructions do not clearly scope the resulting Rev.ai authority.

User impactInstalling or using the skill may grant ongoing access to a Membrane-connected Rev.ai account.

RecommendationUse the least-privileged Rev.ai account or token available, review the Membrane connection permissions, and revoke the connection when no longer needed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityMediumConfidenceHighStatusNote

SKILL.md

send requests directly to the Rev.ai API through Membrane's proxy ... injects the correct authentication headers

Rev.ai requests and authentication are mediated through Membrane's proxy, which is disclosed and purpose-aligned, but it is an important third-party data and credential boundary.

User impactRev.ai API requests, and potentially transcript-related data, may pass through Membrane infrastructure.

RecommendationUse this only if you trust Membrane as an intermediary and avoid sending unnecessary sensitive audio, transcript, or account data.