Clockwork

• Analyzed: Apr 30, 2026, 3:37 PM
• Findings: 1
• Version: 1.0.2
• Hash: b27d273ae67b0528f100f2c1fc99f85874385fb2a845e7f151e057f669f2d49d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle (SKILL.md) instructs the agent to perform high-risk operations, including the global installation of an external CLI tool (`npm install -g @membranehq/cli`) and routing all API traffic through a third-party proxy service (Membrane). While these actions are aligned with the stated purpose of using the Membrane platform for Clockwork integration, the requirement for global software installation and the redirection of authentication and data through an intermediary service represent significant security risks and potential supply-chain vulnerabilities. No evidence of intentional malice or data exfiltration was found.