Athenahealth

• Outcome: Review
• Latest audit: May 29, 2026 at 9:31 PM UTC
• Version:
  1.0.2

Overview

This appears to be a legitimate Athenahealth integration, but it gives an agent broad authenticated access to sensitive healthcare records without enough guardrails.

Install only if you intentionally want an agent to work with Athenahealth through Membrane. Use a least-privileged test or limited-production connection, confirm every create/update/delete request before it runs, prefer vetted Membrane actions over raw proxy calls, and make sure your organization’s healthcare privacy, audit, and access-control requirements are met.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The skill documents a generic proxy mechanism that supports arbitrary HTTP methods including POST, PUT, PATCH, and DELETE against a healthcare platform, but provides no safeguards or warnings about modifying protected health information or operational data. In a healthcare context, this can enable accidental or unauthorized changes to patient, appointment, or billing records, increasing integrity, privacy, and compliance risk.

VirusTotal

58/58 vendors flagged this skill as clean.