instruqt
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the '@membranehq/cli' package from npm, which is an official tool provided by the vendor for managing integrations.
- [COMMAND_EXECUTION]: The skill utilizes the 'membrane' CLI to perform authenticated actions and proxy API requests. These commands are limited to the intended integration logic and do not involve arbitrary command execution.
- [PROMPT_INJECTION]: The skill processes external data from Instruqt (such as track and challenge details), creating a surface for indirect prompt injection.
- Ingestion points: Data retrieved via 'membrane action run' and 'membrane request' commands.
- Boundary markers: No specific delimiters or instruction-ignore warnings are used for external data.
- Capability inventory: Subprocess execution via 'membrane' CLI and network operations through the platform's proxy.
- Sanitization: The instructions do not specify any sanitization or validation of the retrieved technical training data.
Audit Metadata