barcode-lookup
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the
@membranehq/cliNPM package. This is a vendor-owned resource necessary for the skill's functionality. - [COMMAND_EXECUTION]: The skill relies on shell command execution via the
membraneCLI in SKILL.md to manage authentication, list connections, and run actions. - [PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by ingesting data from the external Barcode Lookup API.
- Ingestion points: Output from the
membrane action runandmembrane action listcommands in SKILL.md. - Boundary markers: No specific delimiters or instructions to ignore embedded content are provided.
- Capability inventory: Execution of the
membraneCLI tool for action management and data retrieval in SKILL.md. - Sanitization: The skill does not perform explicit validation or sanitization of the JSON output received from the CLI before processing.
Audit Metadata