wufoo
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the official @membranehq/cli package to manage connections and data. This is a vendor-provided tool.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from Wufoo forms and reports, which represents a potential attack surface where external content could influence agent behavior.
- Ingestion points: Data is retrieved through
membrane action runandmembrane requestcommands as described in SKILL.md. - Boundary markers: The skill documentation does not provide specific instructions or delimiters for the agent to separate untrusted data from instructions.
- Capability inventory: The agent has the capability to perform network requests and retrieve data via the Membrane CLI (SKILL.md).
- Sanitization: There are no mentioned mechanisms for sanitizing or validating the data retrieved from Wufoo API endpoints.
Audit Metadata