popupsmart

Pass

Audited by Gen Agent Trust Hub on Apr 24, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the @membranehq/cli package via npm. This is the official command-line interface provided by the skill's author (membranedev) for interacting with their platform.
  • [COMMAND_EXECUTION]: The skill documents the use of various membrane CLI commands to perform actions like authentication, searching for connectors, and running API requests against Popupsmart.
  • [DATA_EXFILTRATION]: While the skill involves network operations and data retrieval, it explicitly recommends letting the platform handle authentication and credentials, preventing the need for hardcoded keys or user-supplied secrets.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes external data from the Popupsmart API through CLI command outputs.
  • Ingestion points: Data from Popupsmart enters the agent context through the output of membrane action run and membrane request commands.
  • Boundary markers: None explicitly defined in the provided instructions.
  • Capability inventory: The agent is instructed to execute shell commands using the membrane CLI.
  • Sanitization: No specific sanitization or validation of the API response data is mentioned in the instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 24, 2026, 11:31 AM