webhook

Pass

Audited by Gen Agent Trust Hub on May 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the @membranehq/cli package from the public NPM registry to facilitate communication with the Membrane platform.
  • [COMMAND_EXECUTION]: The instructions involve executing various membrane CLI commands for authentication (membrane login), connection management (membrane connect), and running integration actions (membrane action run).
  • [DATA_EXFILTRATION]: While the skill processes external webhook data and can trigger actions, it utilizes a secure, mediated architecture where the vendor (Membrane) handles authentication and credentials server-side, preventing direct exposure of secrets to the agent environment.
  • [PROMPT_INJECTION]: The skill includes positive security constraints, explicitly instructing the agent never to ask users for API keys or tokens and to rely solely on the managed connection system.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The skill is designed to process data from external applications via webhooks.
  • Boundary markers: None explicitly defined in the provided instructions.
  • Capability inventory: Uses the membrane action run command to execute operations based on processed data.
  • Sanitization: Relies on the Membrane platform's internal handling; no specific sanitization logic is provided in the skill instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
May 4, 2026, 12:59 AM