tripetto Security Report — Low Risk | ClawSafe

20 /100

tripetto

Tripetto integration. Manage data, records, and automate workflows.

This is a legitimate Tripetto integration skill documented in SKILL.md with no executable code or malicious behavior detected.

Skill Nametripetto

Duration28.6s

Enginepi

✓

Safe to install

Skill is safe to use. Consider pinning CLI versions in npm install commands for better supply chain hygiene.

Findings 1 items

Severity	Finding	Location
Low	npm install without version pinning Supply Chain The command 'npm install -g @membranehq/cli' does not specify a version, allowing any version to be installed. `npm install -g @membranehq/cli` → Pin to a specific version: npm install -g @membranehq/[email protected]	`SKILL.md:26`

Resource	Declared	Inferred	Status	Evidence
Network	`READ`	`READ`	✓ Aligned	SKILL.md - requires network access for API integration
Shell	`WRITE`	`WRITE`	✓ Aligned	SKILL.md:26-27 - npm install and membrane CLI commands
Filesystem	`NONE`	`NONE`	—	No file operations documented

2 findings

🔗

Medium External URL 外部 URL

https://getmembrane.com

SKILL.md:7

🔗

Medium External URL 外部 URL

https://tripetto.app/docs/

SKILL.md:19

1 files · 4.4 KB · 123 lines

Markdown 1f · 123L

└─ 📝 SKILL.md Markdown 123L · 4.4 KB

✓ No executable code present - purely documentation

✓ Credential handling is server-side through Membrane platform

✓ No credential harvesting or exfiltration

✓ No obfuscation or base64-encoded payloads

✓ No sensitive file access (SSH, AWS, .env)

✓ No reverse shell or C2 indicators

✓ Uses documented CLI tool for legitimate integration

✓ Network access properly declared in compatibility section