Wishpond

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a Wishpond API helper, but it exposes broad authenticated write access to marketing data without clear safeguards.

Install only if you are comfortable granting an agent authenticated access to your Wishpond account. Before using mutating requests, verify the endpoint, payload, and target account, and ask the agent to confirm before creating, updating, or deleting marketing data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill documents a generic authenticated proxy that supports POST, PUT, PATCH, and DELETE against the Wishpond API without requiring confirmation or warning about destructive effects. In an agent setting, this increases the chance that the model may perform unintended state-changing operations on production marketing data, contacts, campaigns, or submissions.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal