Asana

• Analyzed: Apr 30, 2026, 3:42 PM
• Findings: 1
• Version: 1.0.4
• Hash: 3bb64beab2aba98960439bbf53f14337ecaf9c376a3d1086ca301ceaa5d0e6f8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides instructions for an AI agent to manage Asana via the Membrane platform, which involves high-risk actions such as installing a global NPM package (@membranehq/cli) and routing all API traffic through a third-party proxy service (getmembrane.com). While these behaviors are aligned with the stated purpose of the integration, the requirement for global command execution and the use of an external intermediary for sensitive project management data are significant security considerations. No evidence of intentional malice or data exfiltration was found in the provided files (SKILL.md, _meta.json).