v1.0.4

Google My Business

ReviewClawScan verdict for this skill. Analyzed Apr 30, 2026, 3:33 PM.

Analysis

This skill appears aimed at Google Business management, but it asks for persistent Membrane/Google authorization, an unpinned global CLI install, and exposes destructive business-profile actions without clear approval limits.

GuidanceInstall only if you are comfortable using Membrane as a third-party gateway to Google My Business. Pin or verify the Membrane CLI before installing it, connect a least-privilege Google account, review OAuth scopes, and require explicit confirmation before any create, update, delete, or public-facing business-profile action.

Findings (9)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agent Goal Hijack

SeverityLowConfidenceMediumStatusNote

SKILL.md

`clientAction.agentInstructions` (optional) — instructions for the AI agent on how to proceed programmatically.

The skill allows runtime service output to contain instructions directed at the agent. This is purpose-aligned for connection setup, but those instructions should not become more authoritative than the user's goal.

User impactThe agent may be guided by instructions returned during connection setup, which could change how it proceeds if not checked against the user's request.

RecommendationTreat provider-returned instructions as operational hints only, and confirm with the user before following them for sensitive or mutating actions.

Tool Misuse and Exploitation

SeverityHighConfidenceHighStatusConcern

SKILL.md

| Delete Location | delete-location | Deletes a location from Google My Business. | ... | Update Location | update-location | Updates an existing location's information. |

The documented tool actions can delete or modify Google business listings, which are high-impact third-party account and public-profile operations. The instructions do not add explicit approval, scope, or rollback requirements before using them.

User impactA mistaken or overbroad action could remove or alter a business listing or other public Google Business data.

RecommendationRequire explicit user confirmation for every create, update, delete, or public-facing action, and verify the target account/location before running it.

Agentic Supply Chain Vulnerabilities

SeverityMediumConfidenceHighStatusConcern

SKILL.md

`npm install -g @membranehq/cli@latest`

The skill instructs installation of a globally available npm package using the moving @latest tag, which is unpinned and can change over time.

User impactA future or compromised package version could change the behavior of the CLI that the agent relies on.

RecommendationPin the CLI to a reviewed version, install from a trusted source, and avoid global installs where a project-local or managed install is sufficient.

Unexpected Code Execution

SeverityLowConfidenceHighStatusNote

SKILL.md

`npm install -g @membranehq/cli@latest` ... `npx @membranehq/cli connection get <id> --wait --json`

The instruction-only skill still asks the user or agent to install and run external CLI code. This is disclosed and related to the integration, but it expands local execution beyond static instructions.

User impactInstalling or running the CLI executes third-party package code on the local system.

RecommendationRun the CLI only in an environment where npm package execution is acceptable, and prefer pinned versions.

Cascading Failures

SeverityMediumConfidenceHighStatusConcern

SKILL.md

Google My Business helps local businesses manage their online presence across Google, including Search and Maps ... | Delete Location | delete-location | Deletes a location from Google My Business. |

A destructive or incorrect action can affect a business's public presence on Google Search and Maps. The instructions do not describe containment, rollback, or staged review for these changes.

User impactOne incorrect action could propagate to public business information that customers see.

RecommendationUse dry-run or read-only checks first where possible, confirm exact targets with the user, and keep records of any public-facing changes.

Human-Agent Trust Exploitation

SeverityLowConfidenceMediumStatusNote

SKILL.md

Membrane handles authentication and credentials refresh automatically — so you can focus on the integration logic rather than auth plumbing.

The wording frames credential handling as convenience. It is not inherently deceptive, but users should still understand that automatic credential refresh is a sensitive delegation of trust.

User impactA user may underestimate the ongoing access being granted when connecting Google Business through Membrane.

RecommendationMake the credential-retention and revocation implications clear before login, especially for administrator accounts.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityHighConfidenceHighStatusConcern

SKILL.md

Membrane handles authentication and credentials refresh automatically ... `membrane login --tenant --clientName=<agentType>`

The skill delegates account authentication and credential refresh to Membrane, but the artifacts do not define the Google OAuth scopes, role requirements, revocation process, or least-privilege boundaries for the agent.

User impactThe integration may retain delegated access to a Google Business account beyond a single request, enabling future actions through the saved connection.

RecommendationUse a least-privilege Google account, review OAuth scopes during login, revoke the connection when finished, and avoid connecting accounts with unnecessary administrative rights.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityLowConfidenceMediumStatusNote

SKILL.md

Use `membrane connection ensure` to find or create a connection ... The output contains the new connection id.

The skill creates reusable connection state that can be referenced later. This is expected for an integration, but persistent connection context should not be over-trusted across unrelated tasks.

User impactA saved connection ID may let future agent sessions act against the same Google Business connection if access is still valid.

RecommendationTrack which connection is being used, avoid reusing stale or ambiguous connection IDs, and revoke or delete connections that are no longer needed.

Insecure Inter-Agent Communication

SeverityLowConfidenceMediumStatusNote

SKILL.md

This skill uses the Membrane CLI to interact with Google My Business. Membrane handles authentication and credentials refresh automatically

Membrane acts as an intermediary between the agent and Google My Business. This is disclosed and purpose-aligned, but the artifact does not detail data-boundary or permission separation between the agent, Membrane, and Google.

User impactBusiness data and authentication flows may pass through a third-party integration service rather than only between the user and Google.

RecommendationReview Membrane's access model and privacy terms, and only connect business accounts whose data can be routed through that service.