Aspireiq

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate AspireIQ integration, but it gives broad authenticated access to business data and live API changes without clear approval guardrails.

Install only if you intend to give an agent delegated AspireIQ access through Membrane. Use a least-privilege account where possible, review the Membrane connection permissions, and require explicit approval before payments, invoices, bulk edits, deletions, emails, workflow automation, or raw proxy requests.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill explicitly documents a generic proxy mechanism that can send arbitrary HTTP methods, headers, and bodies to the AspireIQ API, but it does not warn that these requests may create, modify, or delete remote data. In an agent setting, this increases the chance that an LLM will use powerful direct API access without sufficient user confirmation or safety checks, leading to unintended state-changing operations.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal