ClawHub

Dimdata

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate DIMDATA integration, but it gives an agent broad authenticated power over sensitive business data without clear write/delete safeguards.

Install only if you trust Membrane and intend to connect DIMDATA to an agent. Use the least-privileged DIMDATA account available, prefer prebuilt read-only actions, and require explicit approval before any create, update, delete, purchase, payment, invoice, employee, or raw proxy operation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The skill description is very broad ('Manage data, records, and automate workflows') and can match many generic user requests involving data, which increases the chance the agent invokes this skill in contexts the user did not specifically intend. Because the skill can authenticate to and operate on live DIMDATA data, overbroad routing can lead to unintended access, queries, or modifications in the connected tenant.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The proxy request section documents arbitrary authenticated API access, including support for POST, PUT, PATCH, and DELETE, but does not warn that these calls act against live DIMDATA resources and may be destructive. In an agent setting, this omission increases the risk of the model issuing unsafe write operations without adequate confirmation, especially since the proxy bypasses the safer discovery flow of prebuilt actions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal