Cincopa

Security checks across malware telemetry and agentic risk

Overview

This Cincopa skill is a coherent integration, but it gives an agent broad account-changing power without enough built-in confirmation guidance.

Install only if you intend to let an agent manage your Cincopa account through Membrane. Use a least-privileged account where possible, review authorization prompts, and require the agent to restate the exact action, target ID, and likely effect before uploads, updates, deletes, webhook changes, live-stream actions, or proxy requests.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill documents destructive actions like deleting assets, galleries, live streams, and webhooks without requiring confirmation or warning about irreversible effects. In an agent setting, this increases the risk of accidental or overly-trusting execution of destructive operations against a live account.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The proxy request feature enables arbitrary authenticated API requests through Membrane, but the skill provides no warning about sending data over the network, hitting sensitive endpoints, or performing destructive state-changing operations. This can bypass safer pre-built actions and materially increases the chance of misuse, including unauthorized modification or deletion if the agent is steered into unsafe requests.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal