Zoho Sheet

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:35 PM UTC
• Version:
  1.0.2

Overview

This is a disclosed Zoho Sheet integration that uses Membrane for authenticated spreadsheet access, with a powerful raw API option users should handle carefully.

Install only if you trust Membrane with the Zoho Sheet account you connect. Prefer listed Membrane actions over raw proxy requests, use the least-privileged Zoho account practical, and explicitly approve any update, bulk edit, or delete before it runs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill explicitly enables direct proxied network requests to the Zoho Sheet API and discusses write-capable HTTP methods, but it does not instruct the agent to warn or confirm with the user before modifying remote spreadsheet data. In practice, this can lead to unintended destructive actions, silent data changes, or overly broad API use without clear user awareness.

VirusTotal

65/65 vendors flagged this skill as clean.