bugzilla
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs the user to install the @membranehq/cli package from the official NPM registry. This package is an official tool from the vendor (Membrane) required for the skill to function.
- [COMMAND_EXECUTION]: The instructions rely on executing the membrane CLI to manage connections and interact with the Bugzilla API. These commands are used as intended for service integration.
- [PROMPT_INJECTION]: The skill is designed to process data from Bugzilla, which introduces a surface for indirect prompt injection from external content.
- Ingestion points: Data retrieved from Bugzilla via membrane action run and membrane request in SKILL.md.
- Boundary markers: No explicit markers are defined to isolate external data from agent instructions.
- Capability inventory: The skill can execute shell commands and make network requests via the membrane CLI (SKILL.md).
- Sanitization: There is no evidence of data sanitization or validation for content fetched from Bugzilla.
Audit Metadata