v1.0.4

Mailboxvalidator

ReviewClawScan verdict for this skill. Analyzed Apr 30, 2026, 3:44 PM.

Analysis

The skill is a plausible MailboxValidator integration, but it gives the agent broad authenticated Membrane access, unpinned CLI installation instructions, and remote agent instructions without clear safeguards.

GuidanceOnly install this skill if you trust Membrane and are comfortable granting it access to your MailboxValidator connection. Pin and verify the Membrane CLI before installing, use a least-privilege account, and require explicit confirmation before the agent runs mutating API requests or follows remote agent instructions.

Findings (8)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agent Goal Hijack

SeverityMediumConfidenceHighStatusConcern

SKILL.md

`clientAction.agentInstructions` (optional) — instructions for the AI agent on how to proceed programmatically.

The skill treats remotely returned connection content as instructions for the agent, which can let external data steer programmatic behavior if not treated as untrusted.

User impactA remote service response could influence what the agent does next, potentially causing actions that were not part of the user's original request.

RecommendationTreat remote agent instructions as advisory data only; do not let them override the user's request, and confirm any meaningful action with the user.

Tool Misuse and Exploitation

SeverityHighConfidenceHighStatusConcern

SKILL.md

`membrane request CONNECTION_ID /path/to/endpoint` ... `--method` | HTTP method (GET, POST, PUT, PATCH, DELETE).

The skill exposes broad authenticated proxy requests with arbitrary paths, methods, headers, and bodies, without explicit approval or endpoint limits.

User impactIf misused, the agent could send authenticated requests that read, change, or delete MailboxValidator account data.

RecommendationRequire explicit user approval for POST, PUT, PATCH, and DELETE requests, and limit proxy use to clearly requested MailboxValidator endpoints.

Agentic Supply Chain Vulnerabilities

SeverityMediumConfidenceHighStatusConcern

SKILL.md

npm install -g @membranehq/cli@latest

The skill tells users to globally install an unpinned npm package using the latest tag, which can change over time and is not captured by the registry install spec.

User impactA changed or compromised CLI release could run on the user's machine with the privileges of the installing user.

RecommendationPin the CLI to a reviewed version and provide a formal install specification or checksum/provenance guidance.

Unexpected Code Execution

SeverityLowConfidenceHighStatusNote

SKILL.md

Install the Membrane CLI so you can run `membrane` from the terminal

The integration depends on installing and running an external command-line tool. That is purpose-aligned, but it is still local code execution.

User impactUsing this skill may run Membrane CLI code locally rather than only sending simple API requests.

RecommendationInstall the CLI only from a trusted source and prefer a pinned, reviewed version.

Cascading Failures

SeverityMediumConfidenceHighStatusConcern

SKILL.md

To pass JSON parameters: `membrane action run <actionId> --connectionId=CONNECTION_ID --input '{"key": "value"}' --json`

The skill can run discovered actions with arbitrary JSON input against an authenticated connection, but does not describe containment, dry-run behavior, or rollback.

User impactA mistaken action choice or parameter could propagate into the connected MailboxValidator account.

RecommendationPreview action schemas and outputs, confirm user intent before state-changing actions, and avoid bulk or destructive operations unless explicitly requested.

Human-Agent Trust Exploitation

SeverityLowConfidenceMediumStatusNote

SKILL.md

description: | MailboxValidator integration. Manage Users, Organizations. ... MailboxValidator is an email verification service that checks if an email address is valid and deliverable.

The description mentions managing users and organizations, while the body describes email validation and credits, creating ambiguity about the intended scope of authority.

User impactUsers may not immediately understand whether the skill is only for email validation or for broader account-management actions.

RecommendationClarify the intended supported operations and disclose whether the skill may modify account, organization, or user data.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityMediumConfidenceHighStatusConcern

SKILL.md

Membrane handles authentication and credentials refresh automatically ... `membrane login --tenant --clientName=<agentType>`

The skill requires delegated Membrane tenant authentication and automatic credential refresh, but the artifacts do not define credential scope, duration, or permission limits.

User impactThe agent may obtain persistent delegated access through Membrane that is broader or longer-lived than the user expects.

RecommendationUse a least-privilege MailboxValidator/Membrane account, review granted scopes, and revoke the connection when finished.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

Membrane's proxy ... injects the correct authentication headers — including transparent credential refresh if they expire.

Requests and credentials are mediated through Membrane as a gateway/proxy, which is purpose-aligned but important for users to understand.

User impactMailboxValidator requests and responses may pass through Membrane, and Membrane handles the authentication headers.

RecommendationUse this only if you are comfortable with Membrane brokering the connection and handling credential refresh.