Azuqua

Security checks across malware telemetry and agentic risk

Overview

This Azuqua skill is coherent, but it grants broad authenticated access that can change or delete business data without clear confirmation safeguards.

Install only if you trust Membrane and are comfortable granting delegated Azuqua access. Use a least-privileged or test account where possible, consider pinning or verifying the Membrane CLI package instead of relying on @latest, and require explicit confirmation before any create, update, delete, workflow automation, bulk operation, or raw proxy request.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill teaches direct action execution and proxy requests, including POST/PUT/PATCH/DELETE, without an explicit warning that these operations can modify or delete remote Azuqua data. In an agent setting, this increases the risk of unintended destructive actions because the operator may treat all documented commands as equally safe.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal