elorus
Pass
Audited by Gen Agent Trust Hub on Apr 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
@membranehq/clipackage from the npm registry, which is the official command-line interface for the platform. - [COMMAND_EXECUTION]: Shell commands are used via the
membraneCLI to perform various API operations such as listing records, running actions, and making direct requests to the Elorus API. - [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface as it processes data retrieved from the Elorus API (e.g., invoice details, contact records).
- Ingestion points: Data retrieved via actions such as
list-invoicesandget-contactare processed by the agent. - Boundary markers: There are no explicit delimiters or instructions provided to separate external data from system instructions.
- Capability inventory: The agent can execute shell commands and perform network operations using the
membraneCLI. - Sanitization: No specific sanitization or validation of content received from the external API is described in the instructions.
- [SAFE]: The skill follows security best practices by utilizing Membrane's mediated connection system for authentication, which eliminates the need for hardcoded API keys or sensitive manual secret entry.
Audit Metadata