nusii-proposals

Pass

Audited by Gen Agent Trust Hub on Apr 22, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill guides the user to install the @membranehq/cli global package using npm. This is the official command-line interface for the author's platform, used to manage integrations and secure connections.
  • [COMMAND_EXECUTION]: Execution of the membrane command is used for legitimate tasks such as logging in, searching for connectors, and running defined actions. The commands are scoped to the functionality of the integration platform.
  • [DATA_EXFILTRATION]: While the skill performs network operations via membrane request and membrane action run, these calls are routed through the vendor's proxy which manages authentication securely. The instructions explicitly advise against requesting or storing raw API keys or tokens locally.
  • [PROMPT_INJECTION]: The skill processes data from the external Nusii Proposals API (e.g., proposal content and action schemas). This introduces a surface for indirect prompt injection where instructions hidden in the API response could attempt to influence the agent. However, this is a standard risk for skills that aggregate external data and is mitigated by the platform's focus on structured actions.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 22, 2026, 07:40 AM