popupsmart
Pass
Audited by Gen Agent Trust Hub on Apr 24, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
@membranehq/clipackage via npm. This is the official command-line interface provided by the skill's author (membranedev) for interacting with their platform. - [COMMAND_EXECUTION]: The skill documents the use of various
membraneCLI commands to perform actions like authentication, searching for connectors, and running API requests against Popupsmart. - [DATA_EXFILTRATION]: While the skill involves network operations and data retrieval, it explicitly recommends letting the platform handle authentication and credentials, preventing the need for hardcoded keys or user-supplied secrets.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes external data from the Popupsmart API through CLI command outputs.
- Ingestion points: Data from Popupsmart enters the agent context through the output of
membrane action runandmembrane requestcommands. - Boundary markers: None explicitly defined in the provided instructions.
- Capability inventory: The agent is instructed to execute shell commands using the
membraneCLI. - Sanitization: No specific sanitization or validation of the API response data is mentioned in the instructions.
Audit Metadata