1C

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed 1C-Bitrix integration with powerful authenticated API access that users should control carefully.

Install only if you trust Membrane and intend to let the agent access the selected 1C-Bitrix account. Prefer built-in Membrane actions, use least-privileged credentials, and require explicit approval before POST, PUT, PATCH, DELETE, bulk exports, workflow automation, or public-site changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill explicitly instructs the agent to use a generic authenticated proxy for arbitrary 1C-Bitrix API paths, including support for POST, PUT, PATCH, and DELETE, but provides no guardrails around user confirmation, scope restriction, or sensitive data handling. In an agent setting, this can enable unintended data exfiltration or destructive state changes if the model chooses a raw request path instead of safer predefined actions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal