simple-analytics

Pass

Audited by Gen Agent Trust Hub on Apr 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions include installing the @membranehq/cli package from the npm registry, which is the official tool for the Membrane platform.
  • [COMMAND_EXECUTION]: Several CLI commands (membrane login, membrane connect, membrane action run) are used to facilitate the integration. These are documented as standard operations for the platform vendor.
  • [DATA_EXFILTRATION]: No sensitive data exposure was detected. The skill uses the vendor's CLI to handle authentication server-side, avoiding the need for local API keys.
  • [PROMPT_INJECTION]: The skill uses natural language intents to discover and create actions, which presents an ingestion surface for potentially untrusted metadata from the Simple Analytics service (Indirect Prompt Injection). \n
  • Ingestion points: Results from the membrane action list and membrane action get commands in SKILL.md. \n
  • Boundary markers: Not present in the CLI command sequence. \n
  • Capability inventory: membrane action run permits execution of code within the Membrane platform context. \n
  • Sanitization: Relies on the vendor's server-side platform validation.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 30, 2026, 08:25 AM