Fiorano Software

• Outcome: Review
• Latest audit: May 29, 2026 at 9:36 PM UTC
• Version:
  1.0.2

Overview

This is a coherent Fiorano/Membrane integration, but it gives the agent broad authenticated API access that can change or delete enterprise workflow data without explicit guardrails.

Install only if you trust Membrane and want an agent to operate on Fiorano through that service. Use a least-privileged Fiorano/Membrane account, review granted scopes, ask the agent to show planned API calls first, and require explicit approval before any create, update, delete, or workflow-changing request.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The skill description is broad enough to match many generic requests about managing data, records, or workflows, which can cause the agent to invoke this skill outside clearly intended Fiorano-specific contexts. Over-broad routing increases the chance of unintended external actions, unnecessary network access, or confusing the user by selecting an irrelevant integration skill.

VirusTotal

64/64 vendors flagged this skill as clean.