v1.0.4

Better Stack

ReviewClawScan verdict for this skill. Analyzed Apr 30, 2026, 3:15 PM.

Analysis

This looks like a legitimate Better Stack integration, but it can install an unpinned global CLI and perform permanent Better Stack changes without clear approval or scope limits.

GuidanceBefore installing, confirm that you trust the Membrane CLI source, prefer a pinned CLI version, connect with the least-privileged Better Stack account possible, and require explicit confirmation before allowing the agent to delete incidents, monitors, heartbeats, or change alerting/user/team settings.

Findings (7)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agent Goal Hijack

SeverityLowConfidenceHighStatusNote

SKILL.md

`clientAction.agentInstructions` (optional) — instructions for the AI agent on how to proceed programmatically.

The skill allows external connection state returned by Membrane to provide agent-facing instructions. This is purpose-aligned for setup, but those instructions should not override the user's request or higher-priority safety rules.

User impactThe agent may be guided by instructions returned from the integration flow, not only by the user's direct request.

RecommendationTreat returned agent instructions as tool output only; keep actions limited to the user's stated Better Stack task and ask for clarification before following unexpected instructions.

Tool Misuse and Exploitation

SeverityHighConfidenceHighStatusConcern

SKILL.md

`Delete Incident` ... `Permanently deletes an existing incident`; `Delete Monitor` ... `Permanently deletes an existing monitor`; `Update Monitor` ... `alert settings`.

The documented Better Stack actions include permanent deletion and alert-configuration changes, but the skill does not require explicit user confirmation, limit actions to specific IDs, or define rollback/containment steps.

User impactA mistaken or overbroad request could permanently remove incidents or monitors, or change alerting behavior in a Better Stack account.

RecommendationRequire explicit user confirmation for deletes, bulk operations, user/team changes, and alert/monitor updates; use least-privilege Better Stack access and verify exact target IDs before execution.

Agentic Supply Chain Vulnerabilities

SeverityMediumConfidenceHighStatusConcern

SKILL.md

npm install -g @membranehq/cli@latest

The skill instructs a global npm install using `@latest`, which is unpinned and can change over time. This creates supply-chain exposure because the reviewed artifact does not include the CLI code being installed.

User impactA future or compromised npm package version could run different code than what the user expected when installing this skill.

RecommendationPin the CLI to a reviewed version, verify the npm publisher and package integrity, and avoid global installs where a local or sandboxed install is sufficient.

Unexpected Code Execution

SeverityMediumConfidenceHighStatusNote

SKILL.md

This skill uses the Membrane CLI to interact with Better Stack ... `npx @membranehq/cli connection get <id> --wait --json`.

The skill is instruction-only, but its normal workflow runs external CLI code through npm/npx. That code execution is expected for the integration, but it is not contained in the reviewed skill artifact.

User impactUsing the skill requires executing code from the Membrane CLI package on the user's machine.

RecommendationOnly run the CLI if you trust the package source, and prefer a pinned version or controlled environment for installation and execution.

Cascading Failures

SeverityHighConfidenceHighStatusConcern

SKILL.md

Better Stack is an infrastructure monitoring platform ... ensure uptime ... `Delete Monitor` ... `Permanently deletes an existing monitor`.

The skill can affect operational monitoring resources. A bad delete or alert-setting change could reduce visibility into production incidents and impact teams that rely on Better Stack.

User impactA single incorrect action could disable monitoring or alerting and cause missed incidents across an operational environment.

RecommendationUse explicit confirmations for destructive monitoring changes, avoid bulk changes unless carefully reviewed, and test changes on non-critical monitors first where possible.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityHighConfidenceHighStatusConcern

SKILL.md

Membrane handles authentication and credentials refresh automatically ... Manage Incidents, Users, Teams.

The skill requires delegated account access and automatic credential refresh for Better Stack management, including user/team-related authority, but does not document scopes, role requirements, token lifetime, or privilege boundaries.

User impactInstalling and using the skill may grant durable access to sensitive Better Stack operations beyond a single task.

RecommendationConnect with a dedicated low-privilege Better Stack account where possible, review OAuth scopes during authorization, and revoke the connection when no longer needed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityMediumConfidenceHighStatusNote

SKILL.md

Use `membrane connection ensure` to find or create a connection ... The user completes authentication in the browser. The output contains the new connection id.

Membrane acts as an intermediary/gateway between the agent and Better Stack. This is disclosed and purpose-aligned, but it means authentication and Better Stack data flow through an external service/CLI boundary.

User impactBetter Stack account data and authentication state may be mediated by Membrane rather than accessed directly by the user.

RecommendationReview Membrane's account, tenant, and data-handling settings before connecting sensitive Better Stack environments.