vanta
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the vendor's command-line interface (@membranehq/cli) from the public NPM registry.- [COMMAND_EXECUTION]: The skill utilizes shell commands via the Membrane CLI to manage authentication, search for Vanta actions, and execute API requests.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process data retrieved from Vanta's external API endpoints.
- Ingestion points: Data returned from the
membrane action runandmembrane requestcommands described inSKILL.mdis ingested into the agent context. - Boundary markers: The instructions do not specify the use of delimiters or explicit boundary markers to isolate external data from instructions.
- Capability inventory: The skill enables the agent to execute shell commands and perform network operations via the CLI tool.
- Sanitization: No specific sanitization or validation protocols are mentioned for the content retrieved from the external API.
Audit Metadata