Truework

• Outcome: Review
• Latest audit: May 29, 2026 at 9:37 PM UTC
• Version:
  1.0.2

Overview

This appears to be a legitimate Truework integration, but it gives agents broad authenticated access to sensitive employment data with limited guardrails around raw API calls and changes.

Install only if you are comfortable connecting a Membrane-managed Truework account. Use a least-privileged account where possible, prefer discovered Membrane actions over raw proxy calls, and require explicit user approval before creating, updating, patching, deleting, or retrieving highly sensitive employment records.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The skill description is overly broad: 'Manage data, records, and automate workflows' could cause an agent to invoke this Truework skill for generic data-management tasks unrelated to employment verification. In a security-sensitive domain handling employment and income records, over-broad routing increases the chance of unnecessary access to sensitive data or use of the wrong integration.

VirusTotal

65/65 vendors flagged this skill as clean.