Miro Developer App

• Analyzed: Apr 30, 2026, 4:02 PM
• Findings: 1
• Version: 1.0.2
• Hash: 3a2e6654732ce654a53a9f7f4ed5e0e0cb65f9e941df34a95389fabb3b5dbb05
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill instructs the AI agent to install a third-party CLI tool globally (`npm install -g @membranehq/cli@latest`) and execute commands for authentication and arbitrary API requests. While these actions are aligned with the stated purpose of using the Membrane platform for Miro integration, the requirement to install external software and the use of a proxy command (`membrane request`) to bypass predefined actions represent a significant attack surface and broad system/network permissions (SKILL.md).