The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to install the @membranehq/cli package globally via npm. This is a standard practice for utilizing the vendor's platform tools.
[COMMAND_EXECUTION]: The skill documentation provides several shell commands using the membrane CLI for logging in, managing connections, and running API actions. These are core to the skill's integration logic.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it retrieves and processes data from the external Yotpo
Loyalty & Referrals API.
Ingestion points: Untrusted data enters the agent context through the outputs of membrane action list, membrane action run, and membrane request (documented in SKILL.md).
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat external data as untrusted or separate from system instructions.
Capability inventory: The agent utilizes shell execution capabilities via the membrane CLI to perform network requests and manipulate remote records (documented in SKILL.md).
Sanitization: No evidence of input/output sanitization or schema validation is present in the provided instructions to mitigate malicious content in the external API responses.

yotpo-loyalty-referrals