Back to skill
Skillv1.0.1
ClawScan security
Zoho People · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 22, 2026, 9:33 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's instructions, requirements, and actions are consistent with a Zoho People integration that uses the Membrane CLI, but it requires installing and trusting a third-party CLI and the Membrane service — verify those before proceeding.
- Guidance
- This skill is coherent for a Zoho People integration that delegates auth and API calls to Membrane, but before installing or using it you should: 1) Verify the legitimacy and reputation of the @membranehq/cli npm package and its publisher (review the package page, maintainer, recent releases, and GitHub repo). 2) Prefer installing a pinned version or local install (avoid -g) or run in an isolated environment if you have concerns. 3) Review Membrane's privacy/security and OAuth scopes — logging in will grant Membrane access to your Zoho People data, so use a least-privilege account if possible. 4) If you need stricter guarantees, ask for details about where credentials are stored, whether Membrane supports enterprise controls, or consider direct Zoho API integration managed by your own tooling.
Review Dimensions
- Purpose & Capability
- okThe skill claims to integrate with Zoho People and all runtime instructions center on using the Membrane CLI to connect, discover actions, and run them. Required capabilities (network access, Membrane account) are appropriate for that purpose and there are no unrelated environment variables, binaries, or config paths requested.
- Instruction Scope
- okSKILL.md stays on-topic: it instructs installing @membranehq/cli, running membrane login/connect, searching and running actions, and how to create actions. It does not ask the agent to read unrelated files, access other credentials, or exfiltrate data outside the Membrane/Zoh o People workflow. It does instruct the user to authenticate via browser (OAuth-style flow) which is expected for this integration.
- Install Mechanism
- noteThe skill is instruction-only (no install spec), but it instructs installing a third-party npm package globally (npm install -g @membranehq/cli@latest). This is a reasonable deployment path for a CLI-based integration, but installing global npm packages runs arbitrary code on the host and requires trusting the package and its publisher. The instructions do not provide package integrity checks or alternative install suggestions (e.g., pinned version or local install).
- Credentials
- okThe skill declares no required environment variables or local credentials; it relies on Membrane to manage Zoho People credentials server-side. That is proportional to the stated purpose, but it does mean the user must trust Membrane with OAuth access to their Zoho People account.
- Persistence & Privilege
- okNo elevated persistence is requested (always:false). Autonomous invocation is allowed by default, which is expected for skills. The skill does not request modifying other skills or system-wide settings.