jack-henry

Pass

Audited by Gen Agent Trust Hub on May 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the @membranehq/cli Node.js package. This is a legitimate dependency from the vendor's official organization on npm.
  • [COMMAND_EXECUTION]: The skill uses shell commands via the membrane CLI to manage authentication and execute business logic. This is the intended design for the integration.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing external data from the Jack Henry API.
  • Ingestion points: API response data from Jack Henry (Customer, Account, Transactions) processed via the membrane CLI.
  • Boundary markers: Absent; no specific delimiters or instructions are provided to isolate the ingested data from the agent's instructions.
  • Capability inventory: The skill allows the agent to execute arbitrary actions via the membrane action run command, providing a path for potential command-driven behaviors.
  • Sanitization: No sanitization or validation of the ingested API data is specified in the instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
May 10, 2026, 03:20 AM