Chocolatey

Security checks across malware telemetry and agentic risk

Overview

This Chocolatey skill is a disclosed Membrane-based integration with expected network and account access, with one caution around its raw API fallback.

Install only if you want Membrane to mediate Chocolatey access for your agent. Prefer listed Membrane actions, and explicitly approve any raw proxy request that changes data or uses POST, PUT, PATCH, or DELETE.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill exposes a generic proxy request mechanism that can send arbitrary HTTP methods and payloads to the connected service, but it does not include an explicit warning to require user confirmation before direct network operations, especially state-changing methods like POST, PUT, PATCH, and DELETE. In an agent setting, this increases the risk of unintended or overbroad actions against external systems if the model chooses the proxy path without adequately surfacing the consequences.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal