rasa-1
Pass
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
@membranehq/clipackage globally via npm. This is a verified vendor resource belonging to the skill's author context, used for managing the integration. - [COMMAND_EXECUTION]: The skill utilizes the
membranecommand-line tool to perform actions such aslogin,connect, andaction run. These operations are standard for the integration and are executed within the user's terminal scope. - [DATA_EXFILTRATION]: The skill implements a proxy request mechanism (
membrane request) to interact with the Rasa API. This pattern is safe as it relies on the vendor's infrastructure for authentication injection and credential refreshing, preventing the exposure of secrets to the local environment or the agent instructions. - [SAFE]: The instructions explicitly emphasize a 'least privilege' approach by discouraging the handling of raw API keys and suggesting the use of pre-built actions which include built-in error handling and pagination.
Audit Metadata