v1.0.4

Superphone

ReviewClawScan verdict for this skill. Analyzed Apr 30, 2026, 5:50 PM.

Analysis

This SuperPhone integration is coherent, but it gives the agent broad authenticated API powers, uses an unpinned external CLI, and relies on persistent credential handling.

GuidanceInstall only if you trust Membrane to mediate SuperPhone access, are comfortable with an unpinned CLI install, and can supervise any write or delete operations. Prefer read-only discovery first, approve every data-changing request explicitly, and revoke the connection when finished.

Findings (8)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agent Goal Hijack

SeverityLowConfidenceMediumStatusNote

SKILL.md

`clientAction.agentInstructions` (optional) — instructions for the AI agent on how to proceed programmatically.

The skill tells the agent that remote connection state may contain instructions directed at the AI, which could steer setup behavior if treated as authoritative.

User impactA returned connection workflow could influence how the agent proceeds during setup.

RecommendationTreat returned agent instructions as operational hints only, and follow them only when they match the user’s explicit SuperPhone task.

Tool Misuse and Exploitation

SeverityHighConfidenceHighStatusConcern

SKILL.md

`membrane request CONNECTION_ID /path/to/endpoint` ... `--method` | HTTP method (GET, POST, PUT, PATCH, DELETE).

The skill grants a generic authenticated proxy to the SuperPhone API, including destructive HTTP methods, without documented approval checks, endpoint limits, or rollback controls.

User impactIf misused, the agent could modify or delete live SuperPhone contacts, conversations, tasks, or other account data.

RecommendationRequire explicit user approval before POST, PUT, PATCH, or DELETE requests, and limit requests to clearly requested SuperPhone endpoints.

Agentic Supply Chain Vulnerabilities

SeverityMediumConfidenceHighStatusConcern

SKILL.md

`npm install -g @membranehq/cli@latest` ... `npx @membranehq/cli@latest` ... `one is created and a connector is built automatically.`

The skill depends on unpinned latest-version npm tooling and dynamically created connector behavior that is not included in the reviewed artifact.

User impactThe behavior users get can change over time or depend on external components that were not reviewed here.

RecommendationPin the CLI version, provide an install specification, and review connector provenance before granting account access.

Unexpected Code Execution

SeverityLowConfidenceHighStatusNote

SKILL.md

Install the Membrane CLI so you can run `membrane` from the terminal: `npm install -g @membranehq/cli@latest`.

The skill has no code files, but its runtime instructions still ask the user or agent to execute package-install and CLI commands.

User impactInstalling and running the CLI can modify the local environment and execute third-party package code.

RecommendationInstall only after confirming the package source, prefer a pinned version, and avoid running the install with unnecessary privileges.

Cascading Failures

SeverityMediumConfidenceMediumStatusNote

SKILL.md

Manage Persons, Organizations, Leads, Deals, Activities, Notes and more ... HTTP method (GET, POST, PUT, PATCH, DELETE).

The skill operates on live business records and supports mutating or deleting API requests, so an incorrect action can have downstream effects across SuperPhone data.

User impactA mistaken request could affect multiple contacts, conversations, tasks, or business records.

RecommendationUse read-only queries first, confirm affected records before writes or deletes, and keep backups or recovery options where possible.

Human-Agent Trust Exploitation

SeverityLowConfidenceMediumStatusNote

SKILL.md

Membrane provides pre-built actions with built-in auth, pagination, and error handling. This will ... make communication more secure.

The instructions make a security assurance about using Membrane, but they do not describe the specific security controls, data handling, or limits behind that claim.

User impactUsers may trust the proxy and action system more than is warranted without reviewing its permissions and data handling.

RecommendationTreat the security claim as a prompt to verify Membrane’s permissions, policies, and connection details before granting access.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityMediumConfidenceHighStatusConcern

SKILL.md

Membrane handles authentication and credentials refresh automatically ... The user completes authentication in the browser. The output contains the new connection id.

The skill requires authenticated Membrane/SuperPhone access and automatic credential refresh, but it does not define least-privilege scope, duration, or revocation steps.

User impactThe integration may retain usable account access beyond a single request, increasing the impact of mistakes or unauthorized actions.

RecommendationUse the least-privileged account available, review OAuth scopes during login, and disconnect or revoke the connection when no longer needed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityMediumConfidenceHighStatusNote

SKILL.md

send requests directly to the SuperPhone API through Membrane's proxy. Membrane ... injects the correct authentication headers.

The skill routes SuperPhone API requests and authentication through Membrane as an intermediary, which is purpose-aligned but creates a sensitive data boundary users should understand.

User impactSuperPhone data and authenticated requests may pass through Membrane’s proxy rather than going directly from the user to SuperPhone.

RecommendationConfirm that using Membrane as a proxy is acceptable for the data involved, and avoid sending unnecessary sensitive information.