snipe-it
Pass
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the '@membranehq/cli' package globally via npm to enable connectivity with the Membrane platform.
- [COMMAND_EXECUTION]: The instructions rely on executing various 'membrane' CLI commands for authentication, connection setup, and performing API actions.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it retrieves and processes untrusted data from the Snipe-IT API (e.g., asset names, user notes). Ingestion points: Data returned from Snipe-IT via 'membrane action run' and 'membrane request' commands. Boundary markers: No delimiters or explicit instructions are provided to the agent to treat external data as untrusted or to ignore embedded instructions. Capability inventory: The skill allows the agent to execute shell commands and perform network requests via the Membrane proxy. Sanitization: There is no evidence of data sanitization or validation performed on the retrieved content before it is processed by the AI.
Audit Metadata