paypal
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the Membrane command-line interface via NPM (
@membranehq/cli@latest). This is a legitimate vendor tool required for the skill's functionality. - [COMMAND_EXECUTION]: The skill relies on the execution of various
membraneCLI commands to manage the lifecycle of PayPal integrations, includinglogin,connect, andaction run. These commands facilitate interactions with the PayPal API through the Membrane platform. - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes natural language intents and descriptions to discover or create PayPal actions.
- Ingestion points: User-supplied strings passed to the
--intentflag inmembrane action listand the description argument inmembrane action create(SKILL.md). - Boundary markers: None present in the command templates.
- Capability inventory: The agent can execute financial operations (e.g.,
create-batch-payout,refund-captured-payment) viamembrane action run. - Sanitization: No client-side sanitization is specified; the skill relies on the Membrane service to interpret and validate the requested actions.
Audit Metadata