中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：22 小时前 重新扫描
5 /100
wirewheel
WireWheel integration for privacy management platform — manage data, records, and automate workflows
WireWheel is a legitimate privacy management platform integration skill that uses the Membrane CLI to interact with WireWheel's API. No malicious code, credential theft, or obfuscation detected — only documentation with standard CLI commands.
技能名称wirewheel
分析耗时28.5s
引擎pi
✓
可以安装
This skill is safe to use. No actionable security concerns identified.

安全发现 1 项

严重性 安全发现 位置
低危
Global npm package installation without pinned version 供应链
The skill instructs users to install @membranehq/cli globally using `npm install -g @membranehq/cli` without specifying a version. This could fetch different versions over time.
npm install -g @membranehq/cli
→ Consider pinning to a specific version: npm install -g @membranehq/[email protected]
 SKILL.md:32
资源类型声明权限推断权限状态证据
网络访问 READ READ ✓ 一致 SKILL.md:56-58 — membrane request passes API calls through Membrane proxy
命令执行 WRITE WRITE ✓ 一致 SKILL.md:32-34 — npm install -g, membrane login, membrane action run
技能调用 ADMIN ADMIN ✓ 一致 SKILL.md:47-53 — membrane action list, membrane action run
文件系统 NONE NONE — No file operations declared or observed
2 项发现
🔗
中危 外部 URL 外部 URL
https://getmembrane.com
SKILL.md:7
🔗
中危 外部 URL 外部 URL
https://docs.wirewheel.io/
SKILL.md:19

目录结构

1 文件 · 10.5 KB · 328 行
Markdown 1f · 328L
└─ 📝 SKILL.md Markdown 328L · 10.5 KB

依赖分析 1 项

包名版本来源已知漏洞备注
@membranehq/cli latest npm 否 Version not pinned; uses @latest tag for global install

安全亮点

✓ No executable code files present — skill is documentation-only
✓ No credential theft or environment variable harvesting detected
✓ No obfuscation, base64-encoded execution, or anti-analysis patterns
✓ No suspicious network connections beyond declared WireWheel API
✓ Credential management handled transparently by Membrane (no local secrets)
✓ All capabilities are clearly declared in SKILL.md
✓ Uses established npm package (@membranehq/cli) from a known vendor
✓ No hidden functionality or doc-to-code mismatch