Freshdesk

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Freshdesk integration that can change or delete support records, so it should be used carefully but does not show hidden or malicious behavior.

Install only if you trust Membrane and are comfortable connecting it to Freshdesk. Use a least-privileged Freshdesk account, verify the selected connection and record IDs, and require explicit user confirmation before create, update, public-note, or delete actions, especially company deletion.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill explicitly documents destructive operations such as deleting tickets, contacts, and companies without any cautionary guidance, confirmation expectations, or mention of irreversible consequences. In an agent setting, this increases the chance that an LLM or user invokes a harmful action without adequate safeguards, especially because the skill is designed to operate against live production support data.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal