Lexoffice

• Analyzed: Apr 30, 2026, 5:47 PM
• Findings: 1
• Version: 1.0.2
• Hash: f0618d0bbe4e0ad40680cbd4ab51211fddde2bfa483fd13c84224447b1c68a2e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides a legitimate integration for Lexoffice using the Membrane CLI and platform (getmembrane.com). It contains instructions for the agent to install the `@membranehq/cli` package, perform OAuth authentication, and interact with Lexoffice APIs via Membrane's action system or proxy. While the SKILL.md file contains an unusually long and generic list of business entities (some of which are irrelevant to accounting), the overall logic follows security best practices by delegating credential management to a dedicated service and avoiding local secret storage. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.