saleor
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the
@membranehq/clipackage from the npm registry. This is a vendor-provided tool used to interact with the Membrane platform and its connectors. - [COMMAND_EXECUTION]: The skill utilizes the
membraneCLI for operations such as authentication (membrane login), action discovery (membrane action list), and triggering Saleor API endpoints (membrane action run). These are standard operations for the tool. - [DATA_EXFILTRATION]: The skill includes documentation on using a proxy for requests, which routes Saleor API traffic through the Membrane platform to securely manage headers and authentication without exposing secrets to the local environment.
- [PROMPT_INJECTION]: The skill processes external data from the Saleor API, which represents a potential surface for indirect prompt injection.
- Ingestion points: Saleor records and API responses retrieved via the
membraneCLI in SKILL.md. - Boundary markers: Not explicitly defined in the provided usage patterns.
- Capability inventory: Shell command execution through the
membraneCLI. - Sanitization: Not specified in the integration guidance.
Audit Metadata