tiendanube
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
@membranehq/clipackage from the NPM registry. This is a vendor-owned tool used to interact with the Membrane platform. - [COMMAND_EXECUTION]: The skill uses the
membranecommand-line interface to manage authentication (membrane login), connection state (membrane connection ensure), and action execution (membrane action run). These commands are standard for the skill's functionality. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from Tiendanube (Nuvemshop) which could theoretically contain malicious instructions.
- Ingestion points: Data retrieved via Tiendanube record operations and action outputs (SKILL.md).
- Boundary markers: Not explicitly mentioned in the skill instructions.
- Capability inventory: Command execution via the Membrane CLI and network proxy requests (SKILL.md).
- Sanitization: Standard handling of structured JSON data by the agent is assumed.
Audit Metadata