Veriff

• Outcome: Review
• Latest audit: May 29, 2026 at 9:37 PM UTC
• Version:
  1.0.2

Overview

This is a coherent Veriff integration, but it gives an agent broad authenticated access to sensitive identity-verification records without enough built-in safeguards.

Review before installing. Use this only if you trust Membrane with Veriff access, and require the agent to show the exact action or API endpoint, HTTP method, payload, requested fields, and expected effect before any raw proxy request or mutating operation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly documents running actions and proxying direct API requests against an identity-verification platform without warning about the sensitivity of the underlying PII and verification data. In this context, absent safeguards can lead an agent to retrieve, transmit, or modify highly sensitive identity records without appropriate user confirmation, minimization, or auditing.

VirusTotal

63/63 vendors flagged this skill as clean.