Affinity

• Outcome: Review
• Latest audit: May 29, 2026 at 9:35 PM UTC
• Version:
  1.0.3

Overview

This Affinity CRM skill is coherent but should be reviewed because it can create or update live business records through a persistent Membrane connection without clear confirmation boundaries.

Install only if you trust Membrane and the npm CLI package, use a least-privileged Affinity account, and require explicit review before creating or updating records. Revoke the Membrane/Affinity connection when it is no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 75% confidence
• Finding: The invocation description is broad enough that an agent may activate this skill for loosely related Affinity requests without strong scope boundaries. In a network-enabled CRM integration, over-broad routing can lead to unintended access, querying, or modification of sensitive business records when the wrong tool is selected.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The skill documents search, retrieval, creation, and update actions against a live CRM but does not clearly warn that these operations transmit data over the network and may create or modify records. In this context, users or agents may invoke write-capable actions without appreciating the external side effects, increasing the risk of unauthorized or accidental data changes.

VirusTotal

64/64 vendors flagged this skill as clean.