Zoho Salesiq

• Outcome: Review
• Latest audit: May 29, 2026 at 9:37 PM UTC
• Version:
  1.0.2

Overview

This is a real Zoho SalesIQ integration, but it gives an agent broad authenticated access to customer and business data without clear approval limits for changes or deletions.

Install only if you trust Membrane and intend to let an agent operate on Zoho SalesIQ data. Use the least-privileged Zoho account available, prefer listed Membrane actions over raw proxy calls, and require explicit confirmation before any POST, PUT, PATCH, DELETE, automation, or bulk operation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the agent to make direct proxy requests to the remote Zoho SalesIQ API, including arbitrary HTTP methods and request bodies, without any safety guidance about data sensitivity, destructive operations, or user confirmation. This can enable unintended reads or writes to business data if an agent follows these instructions too broadly or on ambiguous user requests.

VirusTotal

63/63 vendors flagged this skill as clean.