Zoho Invoice

• Analyzed: May 10, 2026, 7:46 PM
• Findings: 1
• Version: 1.0.2
• Hash: 13d3f6f66e3b58313b8f0436870f9901a5cf2976019fb7efbbf881fb09e6b38f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill facilitates Zoho Invoice integration by instructing the agent to install a global NPM package (`@membranehq/cli`) and use a third-party CLI for authentication and API proxying. While these actions are aligned with the stated purpose in `SKILL.md`, they represent high-risk capabilities—specifically global system modification and external network dependencies—without built-in safeguards. The reliance on an external service (Membrane) to manage credentials and proxy all requests (via `membrane request`) introduces a significant third-party risk surface.