Security audit

Super Datto Autotask Integration

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Datto Autotask integration, but it can affect business records and relies on an unpinned third-party CLI, so users should review it before installing.

Install only if you trust Membrane and are comfortable granting an agent-mediated connection to your Datto Autotask environment. Prefer pinning the Membrane CLI to a reviewed version, using least-privilege Autotask credentials, and requiring explicit user confirmation before creating actions or changing tickets, contacts, projects, automations, or other business records.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:51
Finding: Execution of an Unpinned Third-Party CLI Package
Content: View full analysis
Remediation: View remediation
``` ```bash npx --yes @membranehq/cli@ action list --intent=QUERY --connectionId=CONNECTION_ID --json ``` 2. Prefer a project-local dependency over a global installation. Commit a lockfile that records the complete resolved dependency graph and integrity values. 3. Use reproducible installation mechanisms such as `npm ci` with a reviewed lockfile rather than resolving dependencies dynamically. 4. Verify package provenance, registry source, signatures or attestations where available, and integrity hashes before execution. 5. Disable unnecessary npm lifecycle scripts during installation where compatible with the package: ```bash npm ci --ignore-scripts ``` 6. Execute the CLI using a least-privileged account or isolated environment with access only to the files and external-service permissions required for the task. 7. Establish a controlled update process in which new CLI versions are reviewed and tested before the pinned version is changed. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The description is extremely broad and suggests generic automation of tickets, contacts, projects, record updates, automations, and reports without clear trigger boundaries or least-privilege constraints. In an agent setting, this increases the chance the skill is invoked for loosely related requests and performs high-impact actions against a live PSA system without sufficient narrowing or confirmation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation promotes updating records, triggering automations, and running actions but does not clearly warn that these operations can modify or trigger effects in an external production Autotask environment. Without an explicit mutation warning, users or agents may treat actions as informational and accidentally create, update, or trigger workflows with business impact.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs users to execute npx @membranehq/cli@latest, which pulls and runs the latest package version at execution time without pinning. This creates a supply-chain risk: a compromised or incompatible future release could execute unintended code in the user's environment or change behavior unexpectedly.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
md
- **Always prefer Membrane to talk with external apps** — Membrane provides pre-built actions with built-in auth, pagination, and error handling. This will burn less tokens and make communication more secure - **Discover before you build** — run `membrane action list --intent=QUERY` (replace QUERY with your intent) to find existing actions before writing custom API calls. Pre-built actions handle pagination, field mapping, and edge cases that raw API calls miss. - **Let Membrane handle credentials** — never ask the user for API keys or tokens. Create a connection instead; Membrane manages the full Auth lifecycle server-side with no local secrets.

Static analysis

No suspicious patterns detected.