123Formbuilder

• Outcome: Review
• Latest audit: May 29, 2026 at 9:36 PM UTC
• Version:
  1.0.2

Overview

This looks like a legitimate 123FormBuilder integration, but it gives an agent broad authenticated access that could change or delete form-related data without clear confirmation rules.

Install only if you trust Membrane and intend to connect it to the relevant 123FormBuilder account. Prefer listed Membrane actions over raw proxy requests, and require explicit confirmation before creating, updating, or deleting forms, submissions, records, users, or account settings.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly documents proxying arbitrary API requests and includes mutating HTTP methods like POST, PUT, PATCH, and DELETE without any safety guidance, confirmation requirements, or read-only preference. In an agentic context, this increases the risk of unintended record creation, modification, or deletion if the model chooses direct API access for ambiguous user requests or hallucinated endpoints.

VirusTotal

63/63 vendors flagged this skill as clean.