v1.0.4

Craftmypdf

ReviewClawScan verdict for this skill. Analyzed Apr 30, 2026, 3:22 PM.

Analysis

The skill’s purpose is understandable, but it asks the agent to install and use a Membrane CLI with OAuth-style account access and broad authenticated CraftMyPDF API/proxy actions that are not well bounded.

GuidanceBefore installing, confirm you trust Membrane as an authenticated intermediary for CraftMyPDF, pin and verify the CLI version, use least-privileged credentials, and require explicit approval before any delete, update, user/workspace, webhook, or direct proxy request.

Findings (7)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agent Goal Hijack

SeverityMediumConfidenceHighStatusConcern

SKILL.md

`clientAction.agentInstructions` (optional) — instructions for the AI agent on how to proceed programmatically.

The skill tells the agent that externally returned connection state may contain agent-directed instructions, but it does not say to treat those instructions as untrusted or require user confirmation.

User impactA remote connector or service response could steer the agent’s next steps in ways the user did not explicitly request.

RecommendationTreat any returned agentInstructions as untrusted data, summarize them to the user, and only follow them when they clearly match the user’s request.

Tool Misuse and Exploitation

SeverityHighConfidenceHighStatusConcern

SKILL.md

When the available actions don't cover your use case, you can send requests directly to the CraftMyPDF API through Membrane's proxy... `membrane request CONNECTION_ID /path/to/endpoint`

This exposes a broad authenticated API proxy, and the same skill lists mutating actions such as deleting and updating templates, without explicit approval, scope, or rollback limits.

User impactThe agent could perform high-impact authenticated actions against the user’s CraftMyPDF account, including destructive or unintended changes.

RecommendationRequire explicit user approval before any write, delete, user/workspace, webhook, or direct proxy request; prefer specific listed actions over arbitrary proxy calls.

Agentic Supply Chain Vulnerabilities

SeverityMediumConfidenceHighStatusConcern

SKILL.md

`npm install -g @membranehq/cli@latest` ... If no app is found, one is created and a connector is built automatically.

The skill relies on an unpinned latest npm package installed globally and on automatically built connectors, which creates provenance and version-control gaps not captured by an install spec.

User impactThe code actually executed may change over time or come from generated connector components the user has not reviewed.

RecommendationPin the CLI version, verify the package source, avoid global installation where possible, and review any automatically created connector before using it with credentials.

Unexpected Code Execution

SeverityMediumConfidenceHighStatusConcern

SKILL.md

`npm install -g @membranehq/cli@latest` ... `npx @membranehq/cli connection get <id> --wait --json`

Although the package has no code files in the skill bundle, the instructions cause local execution of npm-distributed CLI code and npx-run code.

User impactUsing the skill can modify the local environment and execute external package code outside the reviewed artifact set.

RecommendationRun the CLI in a constrained environment, pin versions, and avoid executing npx/global installs unless the package and version are trusted.

Cascading Failures

SeverityMediumConfidenceHighStatusConcern

SKILL.md

Manage PDFDocuments, Users, Workspaces... Delete Template | delete-template | Delete a template by ID ... Create PDF Async | create-pdf-async | Generate a PDF document asynchronously with webhook notification

The skill can affect shared workspace resources and asynchronous webhook-driven workflows, but it does not describe containment, dry-run behavior, or approval boundaries for changes.

User impactA mistaken instruction or bad input could propagate into shared templates, workspace data, generated documents, or webhook workflows.

RecommendationConfirm target workspace/template IDs, require approval for mutating or webhook actions, and test with non-production data first.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityHighConfidenceHighStatusConcern

SKILL.md

Membrane handles authentication and credentials refresh automatically... `membrane login --tenant --clientName=<agentType>` ... `connect` — user needs to authenticate (OAuth, API key, etc.).

The skill requires delegated account authentication and automatic credential refresh, while the provided requirements declare no primary credential; the scope of that authority is not clearly bounded.

User impactInstalling or using the skill may grant the agent durable access to a Membrane/CraftMyPDF connection with enough privilege to manage account data.

RecommendationUse the least-privileged account available, verify the exact OAuth/API-key scopes, and revoke the connection when finished.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityMediumConfidenceHighStatusConcern

SKILL.md

send requests directly to the CraftMyPDF API through Membrane's proxy. Membrane automatically appends the base URL to the path you provide and injects the correct authentication headers — including transparent credential refresh

Authenticated requests and credential handling are routed through a gateway/proxy, but the instructions do not clearly define data boundaries, origin validation, or which requests are safe to proxy.

User impactSensitive document data and authenticated API requests may pass through Membrane-controlled infrastructure with broad authority.

RecommendationConfirm that using Membrane as an intermediary is acceptable, avoid sending unnecessary sensitive document data, and restrict direct proxy requests to reviewed endpoints.