nusii-proposals
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill guides the user to install the
@membranehq/cliglobal package using npm. This is the official command-line interface for the author's platform, used to manage integrations and secure connections. - [COMMAND_EXECUTION]: Execution of the
membranecommand is used for legitimate tasks such as logging in, searching for connectors, and running defined actions. The commands are scoped to the functionality of the integration platform. - [DATA_EXFILTRATION]: While the skill performs network operations via
membrane requestandmembrane action run, these calls are routed through the vendor's proxy which manages authentication securely. The instructions explicitly advise against requesting or storing raw API keys or tokens locally. - [PROMPT_INJECTION]: The skill processes data from the external Nusii Proposals API (e.g., proposal content and action schemas). This introduces a surface for indirect prompt injection where instructions hidden in the API response could attempt to influence the agent. However, this is a standard risk for skills that aggregate external data and is mitigated by the platform's focus on structured actions.
Audit Metadata