Aweber

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed AWeber integration that uses Membrane to manage email marketing data, with normal but potentially impactful account actions.

Install this only if you are comfortable giving Membrane delegated access to your AWeber account. Before any delete, update, custom-field creation, or broadcast scheduling action, confirm the exact account, list, subscriber or broadcast ID, message content, and timing. Revoke the Membrane connection when you no longer need it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill documents destructive capabilities such as deleting subscribers and broadcasts, but provides no requirement to confirm intent before executing them. In an agentic setting, this increases the chance of accidental or misinterpreted requests leading to irreversible state changes in a live marketing account.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal