simplekpi
Pass
Audited by Gen Agent Trust Hub on Apr 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
@membranehq/clipackage from the official NPM registry. This is a standard procedure for using the vendor's CLI tool. - [COMMAND_EXECUTION]: The skill relies on executing various
membraneCLI commands to manage connections and run actions against the SimpleKPI API. - [PROMPT_INJECTION]: A surface for indirect prompt injection exists because the skill processes data retrieved from the external SimpleKPI API.
- Ingestion points: Output from the
membrane action runcommand (SKILL.md). - Boundary markers: Absent; the skill does not explicitly define delimiters for external data.
- Capability inventory: The skill uses shell command execution via the
membraneCLI (SKILL.md). - Sanitization: None detected; the skill processes API responses directly.
Audit Metadata