Dataddo

• Outcome: Pass
• Latest audit: May 27, 2026 at 10:51 PM UTC
• Version:
  1.0.2

Overview

This is a coherent Dataddo integration skill that uses Membrane CLI for authenticated Dataddo actions, with no evidence of hidden, destructive, or unrelated behavior.

Before installing, verify that you trust Membrane and the @membranehq/cli npm package, especially because the instructions recommend a global npm install and Membrane will handle Dataddo authentication. Use it only for Dataddo-related tasks and review any write, delete, or raw proxy request before allowing it to run.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The description is overly broad: 'Manage data, records, and automate workflows' could cause the skill to activate for many generic user requests unrelated to Dataddo specifically. Over-broad activation increases the chance the agent selects this skill in the wrong context, which can lead to unintended external actions or data access through an authenticated Dataddo connection.

VirusTotal

VirusTotal findings are pending for this skill version.