liferay
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill operates by executing commands via the
membraneCLI to manage connections, perform searches, and run actions against the Liferay API. - [EXTERNAL_DOWNLOADS]: The skill instructions include the installation of the
@membranehq/clipackage from the NPM registry, which is the core tool for this integration. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with user-generated content from Liferay (such as blog posts and wiki pages) which constitutes an indirect prompt injection surface.
- Ingestion points: Data retrieved from Liferay blogs, wikis, and messages via
membrane action runormembrane request(inSKILL.md). - Boundary markers: No specific delimiters or "ignore" instructions are provided for handling data returned from Liferay.
- Capability inventory: The agent can execute shell commands via the CLI, write to the filesystem, and perform network operations.
- Sanitization: The instructions do not specify any validation or filtering of the content ingested from Liferay.
Audit Metadata