transform
Pass
Audited by Gen Agent Trust Hub on Apr 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the Membrane CLI package (
@membranehq/cli) from the official NPM registry, which is a well-known service. This is a standard setup procedure for the vendor's integration ecosystem.- [COMMAND_EXECUTION]: UtilizesmembraneCLI commands to perform administrative and data tasks, such as authentication (membrane login), establishing service connections (membrane connect), and executing automation logic (membrane action run).- [CREDENTIALS_UNSAFE]: Adheres to security best practices by explicitly instructing the agent not to ask for or store API keys locally, instead relying on the Membrane platform's server-side authentication lifecycle.- [PROMPT_INJECTION]: The skill facilitates action discovery and creation by passing user-supplied natural language descriptions to CLI commands. While this introduces an indirect prompt injection surface, it is a functional requirement for the skill's intended purpose. - Ingestion points: User-provided intent strings in
membrane action listandmembrane action create. - Boundary markers: Arguments are enclosed in double quotes within the CLI examples.
- Capability inventory: The skill can execute actions on the TransForm API and manage connections via the CLI.
- Sanitization: Not explicitly implemented within the instruction set; relies on the underlying CLI tool's argument handling.
Audit Metadata