zoho-projects

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the official @membranehq/cli package from the NPM registry, which is a well-known and expected source for the vendor's tools.
  • [COMMAND_EXECUTION]: The skill uses the membrane command-line tool to perform administrative and data operations, such as authenticating with Zoho Projects, managing connections, and executing API actions.
  • [INDIRECT_PROMPT_INJECTION]: The skill acts as a data ingestion point for Zoho Projects records, creating a surface where instructions embedded in external project data could influence the agent.
  • Ingestion points: Data retrieved from the Zoho Projects API via the membrane action run and membrane request commands (SKILL.md).
  • Boundary markers: No specific delimiters or instructions to ignore embedded content are provided.
  • Capability inventory: Shell command execution via the membrane CLI and installation of global Node.js packages (SKILL.md).
  • Sanitization: The skill relies on the agent's inherent ability to process external data safely without explicit sanitization steps.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 05:44 AM