Vivomeetings

• Outcome: Review
• Latest audit: May 29, 2026 at 9:37 PM UTC
• Version:
  1.0.2

Overview

This skill is a coherent Vivomeetings integration, but it gives an agent broad authenticated API access that can change or delete account data without clear confirmation guardrails.

Install only if you are comfortable connecting a Vivomeetings account through Membrane. Prefer built-in Membrane actions over raw proxy requests, require explicit confirmation before creating, updating, or deleting Vivomeetings data, and revoke the Membrane connection when it is no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill documents a generic proxy request mechanism supporting POST, PUT, PATCH, and DELETE without requiring user confirmation or warning that these methods may modify or destroy remote data. In an agent setting, this can encourage unsafe direct API use and accidental state-changing operations against a user's Vivomeetings account.

VirusTotal

63/63 vendors flagged this skill as clean.