cloudcraft
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by ingesting and processing data from external Cloudcraft environments and actions.
- Ingestion points: Data returned to the agent from
membrane action listandmembrane action runcommands in SKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified for the processed data.
- Capability inventory: The skill uses the Membrane CLI to interact with cloud infrastructure, manage connections, and execute automated actions.
- Sanitization: No specific sanitization or validation of the content retrieved from Cloudcraft is mentioned.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the Membrane CLI (
@membranehq/cli) from the public npm registry. This is an expected dependency originating from the skill vendor's official scope.
Audit Metadata