Api To Every Ecommerce Cart And Marketplace

• Outcome: Review
• Latest audit: May 28, 2026, 3:29 PM
• Version:
  1.0.4

Overview

This appears to be a legitimate Membrane e-commerce connector, but it gives agents broad authenticated access that could change or delete store data without explicit safety controls.

Install only if you trust Membrane and need broad e-commerce API access. Use the least-privileged store or marketplace account available, prefer listed Membrane actions over raw proxy requests, and require explicit confirmation before creating, updating, deleting, publishing, refunding, or bulk-changing any records.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill documents a generic authenticated proxy request capability that supports mutating HTTP methods like POST, PUT, PATCH, and DELETE, but it does not require confirmation, warn about side effects, or constrain usage to read-only operations. In an agent setting, this increases the risk of unintended or overly broad modifications to connected third-party e-commerce systems, including orders, products, and customer data.

VirusTotal

VirusTotal findings are pending for this skill version.