vectorizedio
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
@membranehq/clipackage from the official NPM registry. This package is the primary tool for managing integrations provided by the vendor. - [COMMAND_EXECUTION]: The skill uses the
membraneCLI to perform authentication, query available actions, and execute data workflows. - [PROMPT_INJECTION]: The skill processes data returned from external actions, which represents a surface for indirect prompt injection.
- Ingestion points: Results from
membrane action listandmembrane action runcommands inSKILL.md. - Boundary markers: Absent; the agent is not instructed to use specific delimiters or ignore embedded instructions within action outputs.
- Capability inventory: Shell command execution via the
membraneCLI inSKILL.md. - Sanitization: Absent; the skill instructions do not include steps to validate or sanitize external output before processing.
Audit Metadata