simple-analytics
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions include installing the
@membranehq/clipackage from the npm registry, which is the official tool for the Membrane platform. - [COMMAND_EXECUTION]: Several CLI commands (
membrane login,membrane connect,membrane action run) are used to facilitate the integration. These are documented as standard operations for the platform vendor. - [DATA_EXFILTRATION]: No sensitive data exposure was detected. The skill uses the vendor's CLI to handle authentication server-side, avoiding the need for local API keys.
- [PROMPT_INJECTION]: The skill uses natural language intents to discover and create actions, which presents an ingestion surface for potentially untrusted metadata from the Simple Analytics service (Indirect Prompt Injection). \n
- Ingestion points: Results from the
membrane action listandmembrane action getcommands in SKILL.md. \n - Boundary markers: Not present in the CLI command sequence. \n
- Capability inventory:
membrane action runpermits execution of code within the Membrane platform context. \n - Sanitization: Relies on the vendor's server-side platform validation.
Audit Metadata