showpad
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions include installing the
@membranehq/cliNode.js package. This is an official tool provided by the vendor for managing integrations. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from the Showpad sales enablement platform, which introduces a potential surface for indirect prompt injection.
- Ingestion points: Data enters the agent's context through tools like
membrane action run,membrane request, andmembrane connection getwhen retrieving file, folder, user, or share information from Showpad. - Boundary markers: The provided instructions do not specify the use of delimiters or specific instructions for the agent to ignore potentially malicious content embedded within Showpad data.
- Capability inventory: The agent has the capability to execute shell commands via the Membrane CLI, perform network requests to the Showpad API, and execute actions that can modify remote state.
- Sanitization: There are no explicit mentions of sanitizing, filtering, or validating the content retrieved from external API endpoints before it is processed by the agent.
Audit Metadata