clevertap

Pass

Audited by Gen Agent Trust Hub on Apr 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Membrane CLI (membrane) to perform authentication, manage connections, and execute actions. These commands are necessary for interacting with the CleverTap platform.
  • [EXTERNAL_DOWNLOADS]: The instructions include a command to install the @membranehq/cli package from the npm registry. This is the official CLI tool provided by the vendor (membranedev) to facilitate the integration.
  • [SAFE]: The skill adheres to security best practices by explicitly instructing the agent not to request sensitive credentials like API keys or tokens from the user, instead delegating authentication to the Membrane platform's managed connection flow.
  • [SAFE]: Indirect Prompt Injection Surface Analysis: 1. Ingestion points: User-provided intents and descriptions are passed to membrane action list and membrane action create. 2. Boundary markers: No explicit delimiters or boundary markers are defined in the command examples. 3. Capability inventory: The skill uses the membrane CLI, which can perform network requests and execute platform actions. 4. Sanitization: No explicit sanitization or filtering of user input is described in the skill instructions. This is an expected pattern for natural-language-to-action mapping within the platform.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 29, 2026, 04:52 PM
Security Audit — agent-trust-hub — clevertap