semaphore
Pass
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@membranehq/clipackage from npm to function. - [COMMAND_EXECUTION]: The skill executes multiple shell commands using the
membranebinary to manage connections, list actions, and perform API requests. - [PROMPT_INJECTION]: Indirect injection surface detected. 1. Ingestion points: Data retrieved from Semaphore projects, environments, or logs via
membrane action runandmembrane request. 2. Boundary markers: Absent. No specific delimiters or instructions to ignore embedded content are provided in the skill instructions. 3. Capability inventory: Execution of API actions and raw HTTP requests via themembraneCLI tool. 4. Sanitization: None mentioned.
Audit Metadata