constant-contact
Pass
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@membranehq/clipackage from the NPM registry. This is a legitimate vendor resource provided by the author (membranedev) to manage integrations on their platform. - [COMMAND_EXECUTION]: The skill utilizes the
membranecommand-line tool to handle authentication, manage service connections, and execute API actions. These operations are consistent with the skill's stated purpose of interacting with the Constant Contact API. - [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it retrieves and processes data from an external source (Constant Contact).
- Ingestion points: Data ingested from Constant Contact API endpoints via
membrane action runandmembrane request(SKILL.md). - Boundary markers: None identified in the skill instructions.
- Capability inventory: The skill has the ability to execute shell commands via the
membraneCLI (SKILL.md). - Sanitization: No explicit sanitization or validation of the external API response data is performed within the skill instructions.
Audit Metadata