travelport

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the @membranehq/cli package from the NPM registry. This is an official command-line tool provided by the vendor (Membrane) for managing connections and interacting with their services.
  • [COMMAND_EXECUTION]: The skill utilizes the membrane CLI to perform operational tasks such as authenticating, creating connections to Travelport, searching for actions, and executing API requests. These commands are standard and necessary for the skill's documented purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from the Travelport API, creating a potential surface for indirect prompt injection.
  • Ingestion points: API responses, flight data, and action schemas are retrieved from Travelport via the membrane CLI in SKILL.md.
  • Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the external API data as untrusted or to ignore embedded instructions.
  • Capability inventory: The skill possesses the ability to execute shell commands via the CLI and perform network operations through the Membrane proxy as described in SKILL.md.
  • Sanitization: No explicit sanitization or validation logic is specified for the external data ingested from Travelport.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 01:55 PM