documenterra

Pass

Audited by Gen Agent Trust Hub on Apr 29, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill utilizes the official @membranehq/cli package, which is a verified tool from the skill's author (membranedev) used for managing API integrations.\n- [SAFE]: Authentication is handled securely through the Membrane platform's OAuth flow (membrane login). This approach avoids the need for hardcoded secrets or asking the user to manually provide API keys, reducing the risk of credential exposure.\n- [SAFE]: The skill includes a surface for indirect prompt injection by processing external data from Documenterra, but this is handled as part of the intended functionality and within safe parameters.\n
  • Ingestion points: Output from membrane action run and membrane action list commands which fetch data from the Documenterra API (e.g., user lists, page content).\n
  • Boundary markers: Not explicitly defined in the instructions provided in the skill.\n
  • Capability inventory: The agent can execute membrane CLI commands to manage connections and run pre-defined or dynamically created actions via the Membrane platform.\n
  • Sanitization: Not explicitly performed on the retrieved content before it enters the agent's context.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 29, 2026, 06:50 PM