Back to skill
Skillv1.0.3
ClawScan security
Uscreen · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 22, 2026, 9:23 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's instructions, requirements, and scope are internally consistent with a Uscreen integration that delegates auth and API work to the Membrane CLI/service.
- Guidance
- This skill is coherent: it instructs the agent to use the Membrane CLI to talk to Uscreen rather than asking for raw API keys. Before installing or following these steps: (1) Review Membrane's security/privacy docs and decide whether you trust a third party to hold your Uscreen credentials and act on your behalf. (2) Prefer pinning a CLI version (avoid unpinned @latest) or using npx for one-off runs if you don't want a global install. (3) Be aware that completing the interactive login grants the connector access to your Uscreen data—only authorize accounts you trust. (4) If you prefer not to use a third-party intermediary, use direct Uscreen API integration instead (which will require different, explicit credentials).
Review Dimensions
- Purpose & Capability
- okName and description (Uscreen integration) match the instructions: the skill directs the agent to use the Membrane CLI and a Uscreen connector to list, create, and run actions against Uscreen data. No unrelated credentials, binaries, or capabilities are requested.
- Instruction Scope
- okSKILL.md stays on-task: it tells the user/agent how to install and use the Membrane CLI, authenticate, create connections, discover actions, and run them. It does not instruct reading unrelated files, environment variables, or exfiltrating data to unexpected endpoints. It does require network access and a Membrane account (documented).
- Install Mechanism
- noteThe skill is instruction-only (no install spec), but it explicitly recommends installing @membranehq/cli from npm (npm install -g @membranehq/cli@latest) and uses npx in examples. Using a public npm package is normal, but recommending the unpinned @latest global install has minor risk (unexpected upstream changes). The skill itself does not automatically download or execute code.
- Credentials
- noteNo environment variables or local secrets are required by the skill. However, the workflow delegates auth and credential storage to Membrane (a third-party service). That is proportionate for this integration but means users must trust Membrane with access to their Uscreen account and data.
- Persistence & Privilege
- okThe skill does not request permanent inclusion (always:false) and has no install-time actions or files. Default autonomous invocation is allowed (platform default) and is not combined with other concerning privileges.