中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 15/100
上次扫描：2 天前 重新扫描
15 /100
paygreen
PayGreen integration for payment processing with Membrane CLI
PayGreen integration skill using Membrane CLI with transparent documentation; no hidden malicious behavior detected.
技能名称paygreen
分析耗时26.7s
引擎pi
✓
可以安装
Skill appears safe. Consider pinning the CLI version in production for reproducibility.

安全发现 1 项

严重性 安全发现 位置
低危
CLI package version not pinned
The skill instructs users to install @membranehq/cli without a version pin or @latest tag, which could lead to unexpected updates. This is a minor reproducibility concern, not a security issue.
npm install -g @membranehq/cli
→ Consider pinning to a specific version or using @latest for latest stable release
 SKILL.md:25
资源类型声明权限推断权限状态证据
文件系统 NONE NONE — No file operations found; SKILL.md is documentation only
网络访问 READ READ ✓ 一致 SKILL.md:1 - External URLs (getmembrane.com, developers.paygreen.fr) and API pro…
命令执行 WRITE WRITE ✓ 一致 SKILL.md:25 - npm install -g @membranehq/cli is explicitly documented
浏览器 READ READ ✓ 一致 SKILL.md:31 - Browser-based OAuth authentication flow is documented
2 项发现
🔗
中危 外部 URL 外部 URL
https://getmembrane.com
SKILL.md:7
🔗
中危 外部 URL 外部 URL
https://developers.paygreen.fr/
SKILL.md:19

目录结构

1 文件 · 4.2 KB · 121 行
Markdown 1f · 121L
└─ 📝 SKILL.md Markdown 121L · 4.2 KB

依赖分析 1 项

包名版本来源已知漏洞备注
@membranehq/cli unpinned npm 否 No version specified; installs whatever is latest in registry

安全亮点

✓ All network access is declared in documentation
✓ Credential handling is explicitly managed by Membrane (no local secrets stored)
✓ No hidden subprocess execution or eval patterns
✓ No access to sensitive paths (~/.ssh, ~/.aws, .env)
✓ No base64 encoded payloads or obfuscated code
✓ No credential harvesting or data exfiltration
✓ OAuth flow uses standard browser-based authentication
✓ Skill is open source with clear MIT license