Gohighlevel

• Outcome: Review
• Latest audit: May 29, 2026 at 9:37 PM UTC
• Version:
  1.0.5

Overview

This GoHighLevel skill is mostly coherent, but it enables broad CRM changes and raw API requests without clear confirmation or scope limits.

Review before installing. Use this only with a GoHighLevel account whose permissions you are comfortable delegating to Membrane, prefer read/list actions first, and require explicit approval before any create, update, delete, payment, refund, messaging, workflow, export, or raw proxy request.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly exposes destructive capabilities such as deleting contacts and opportunities, but the description and guidance do not warn the user or require confirmation before high-impact actions. In an agent setting, that omission increases the risk of accidental or unauthorized destructive operations, especially when actions are easy to discover and invoke through the CLI.

VirusTotal

62/62 vendors flagged this skill as clean.