中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 15/100
上次扫描：2 天前 重新扫描
15 /100
telesign
TeleSign integration for phone verification, SMS messaging, and fraud prevention via Membrane CLI
A legitimate TeleSign integration skill using the Membrane CLI for phone verification and SMS workflows. All capabilities are declared, no hidden functionality detected.
技能名称telesign
分析耗时23.9s
引擎pi
✓
可以安装
Approve for use. The skill is transparent about its npm dependency and CLI commands. Consider pinning CLI version for reproducibility.

安全发现 2 项

严重性 安全发现 位置
低危
Global npm installation
The skill requires installing the Membrane CLI globally via npm. While declared, this modifies system state.
npm install -g @membranehq/cli
→ Document version pinning: npm install -g @membranehq/cli@latest
 SKILL.md:25
提示
External dependency on Membrane service
The skill relies on the Membrane CLI (membranehq.com) for all API interactions. This introduces a third-party trust dependency.
This skill uses the Membrane CLI to interact with TeleSign
→ Verify Membrane's security posture and privacy policy before deployment
 SKILL.md:1
资源类型声明权限推断权限状态证据
命令执行 WRITE WRITE ✓ 一致 npm install -g @membranehq/cli
网络访问 READ READ ✓ 一致 membrane request CONNECTION_ID /path/to/endpoint
文件系统 NONE NONE — No direct file operations
环境变量 NONE NONE — No env access detected
技能调用 NONE NONE — No inter-skill invocation
剪贴板 NONE NONE — No clipboard access
浏览器 NONE NONE — Browser used via CLI OAuth flow only
数据库 NONE NONE — No database access
2 项发现
🔗
中危 外部 URL 外部 URL
https://getmembrane.com
SKILL.md:7
🔗
中危 外部 URL 外部 URL
https://developers.telesign.com/docs/rest-api-overview
SKILL.md:19

目录结构

1 文件 · 4.6 KB · 130 行
Markdown 1f · 130L
└─ 📝 SKILL.md Markdown 130L · 4.6 KB

依赖分析 1 项

包名版本来源已知漏洞备注
@membranehq/cli latest npm 否 Version not pinned - recommend using explicit version

安全亮点

✓ All shell commands are explicitly declared in documentation
✓ No credential harvesting - uses OAuth flow via Membrane
✓ No base64, obfuscation, or hidden payloads detected
✓ Best practices explicitly advise against asking users for API keys
✓ Transparent about external API calls through Membrane proxy
✓ Uses legitimate, documented CLI tool (Membrane)
✓ No access to sensitive paths (~/.ssh, ~/.aws, .env)
✓ No reverse shell, C2, or data exfiltration patterns