zoho-creator
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
membraneCLI tool to perform operations such as authentication, connection management, and action execution. This is a standard architectural pattern for this vendor's ecosystem. - [EXTERNAL_DOWNLOADS]: The skill guides the user to install the
@membranehq/clipackage from the public npm registry. This is a legitimate dependency provided by the skill's author to enable the integration's functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Zoho Creator (records, reports, and fields) through the
membrane action runcommand. This represents a potential surface for indirect prompt injection if retrieved data contains malicious instructions. However, the skill adheres to the vendor's standard data handling patterns.
Audit Metadata