zoho-projects
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the official
@membranehq/clipackage from the NPM registry, which is a well-known and expected source for the vendor's tools. - [COMMAND_EXECUTION]: The skill uses the
membranecommand-line tool to perform administrative and data operations, such as authenticating with Zoho Projects, managing connections, and executing API actions. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a data ingestion point for Zoho Projects records, creating a surface where instructions embedded in external project data could influence the agent.
- Ingestion points: Data retrieved from the Zoho Projects API via the
membrane action runandmembrane requestcommands (SKILL.md). - Boundary markers: No specific delimiters or instructions to ignore embedded content are provided.
- Capability inventory: Shell command execution via the
membraneCLI and installation of global Node.js packages (SKILL.md). - Sanitization: The skill relies on the agent's inherent ability to process external data safely without explicit sanitization steps.
Audit Metadata