Back to skill
Skillv1.0.3
ClawScan security
Webinarfuel · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 22, 2026, 1:34 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements and instructions are consistent with its stated purpose — it delegates WebinarFuel access to the Membrane CLI and does not ask for unrelated credentials or system access.
- Guidance
- This integration looks coherent: it uses the Membrane CLI to manage WebinarFuel access and does not request unrelated credentials. Before installing or running it, confirm you trust Membrane (getmembrane.com / the npm package @membranehq/cli), review the CLI's source/permissions, and prefer npx or a local install to avoid global npm changes. When you authenticate, check the OAuth scopes the service requests and avoid pasting secrets into chat. If you need stricter isolation, run the CLI in a dedicated environment or container.
Review Dimensions
- Purpose & Capability
- okThe skill describes a WebinarFuel integration and all runtime instructions use the Membrane CLI to connect, discover, build, and run actions against WebinarFuel. Requesting a Membrane account and network access matches the stated purpose.
- Instruction Scope
- okSKILL.md limits guidance to installing and using the Membrane CLI (login, connect, action list/create/run). It does not instruct the agent to read arbitrary local files, access unrelated environment variables, or exfiltrate data to unexpected endpoints.
- Install Mechanism
- noteThere is no formal install spec in the package — instructions tell the user to install @membranehq/cli via npm -g or run via npx. Installing an npm package is expected for a CLI-driven integration, but global npm installs have broader system impact; using npx or reviewing the package source is safer.
- Credentials
- okThe skill declares no required env vars or credentials. Authentication is delegated to Membrane (OAuth/browser flow), which is proportionate to the task. No unrelated secrets or config paths are requested.
- Persistence & Privilege
- okThe skill is instruction-only, not always-enabled, and requests no system-wide persistent privileges or modifications to other skills. It relies on the user running the Membrane CLI interactively or via agent-invoked commands.