Microsoft Azure Sql Database

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Membrane-based Azure SQL Database integration, with a broad raw API fallback that users should handle carefully.

Install only if you trust Membrane and intend to let an agent operate on the connected Azure SQL environment. Prefer discovered Membrane actions first, review any POST, PUT, PATCH, or DELETE request before it runs, use least-privilege Azure permissions where possible, and revoke the Membrane connection when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill explicitly enables direct proxy requests with arbitrary HTTP methods, headers, query parameters, and raw bodies, but does not warn that these requests may create, alter, or delete remote resources. In a database-management context, this increases the chance that an agent or user will perform destructive operations without confirmation, review, or least-privilege safeguards.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal