hotspotsystem
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
@membranehq/clipackage via npm. This is the official command-line tool for the Membrane platform, which the skill uses as its runtime environment. - [COMMAND_EXECUTION]: The skill uses various
membraneCLI commands to manage the integration lifecycle, includingmembrane loginfor authentication,membrane connectfor linking HotspotSystem accounts, andmembrane action runfor executing API requests. These commands are standard for the vendor's ecosystem. - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it retrieves and processes data from the HotspotSystem API (such as customer details or transaction logs).
- Ingestion points: Data returned from
membrane action runis processed by the agent. - Boundary markers: None explicitly defined in the provided instructions.
- Capability inventory: The skill can execute CLI commands, perform network operations via the Membrane platform, and access the local terminal.
- Sanitization: There are no explicit instructions for the agent to sanitize or escape the content retrieved from the external API.
Audit Metadata