timing
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the @membranehq/cli package from npm. This is a standard deployment of the vendor's official command-line utility.
- [COMMAND_EXECUTION]: The documentation describes the use of shell commands for logging in and executing API actions through the platform's CLI.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from the Timing API, which presents a surface for indirect prompt injection.
- Ingestion points: Data retrieved through action list and action run commands in SKILL.md.
- Boundary markers: The instructions do not define specific delimiters to isolate external API content from agent instructions.
- Capability inventory: The agent can perform further actions and network requests based on the information it receives (SKILL.md).
- Sanitization: The documentation does not outline any specific filtering or sanitization steps for data fetched from the external service.
Audit Metadata