Reputation Lyncs

• Outcome: Review
• Latest audit: May 29, 2026 at 9:37 PM UTC
• Version:
  1.0.2

Overview

This skill is a coherent Reputation Lyncs integration, but it gives an agent broad authenticated access that can change or delete business data without clear confirmation guardrails.

Install only if you trust Membrane and are comfortable letting an agent act through your Reputation Lyncs account. Use the least-privileged account available, prefer discovered Membrane actions over raw proxy calls, and require clear confirmation before any create, update, publish, or delete request.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly documents a generic proxy mechanism that supports mutating HTTP methods like POST, PUT, PATCH, and DELETE without any warning to require user confirmation before data-changing operations. In an agent setting, this increases the chance that the model performs destructive or unauthorized state changes against the connected Reputation Lyncs account based on ambiguous prompts or prompt injection.

VirusTotal

63/63 vendors flagged this skill as clean.