中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 15/100
上次扫描：1 天前 重新扫描
15 /100
plaid
Plaid integration for managing banking data, transactions, and workflows via Membrane CLI
Single-file Plaid integration skill using Membrane CLI; all functionality is documented with no hidden behavior, though npm install lacks version pinning.
技能名称plaid
分析耗时24.9s
引擎pi
✓
可以安装
Pin the CLI version in the install command (e.g., `@membranehq/[email protected]`) to prevent unexpected updates.

安全发现 1 项

严重性 安全发现 位置
低危
Unpinned npm package version 供应链
The command `npm install -g @membranehq/cli` installs the latest version of the Membrane CLI without version pinning. This could allow a malicious actor to publish a new version with compromised code that gets installed on update.
npm install -g @membranehq/cli
→ Pin to a specific version: `npm install -g @membranehq/[email protected]` or use a hash-based verification.
 SKILL.md:26
资源类型声明权限推断权限状态证据
文件系统 NONE NONE — No file operations described or performed
网络访问 READ READ ✓ 一致 Membrane proxy requests to Plaid API; documented in SKILL.md
命令执行 WRITE WRITE ✓ 一致 npm install and membrane CLI commands; declared in SKILL.md
环境变量 NONE NONE — No environment variable access documented or observed
技能调用 NONE NONE — No cross-skill invocation
剪贴板 NONE NONE — No clipboard operations
浏览器 NONE NONE — OAuth flow uses external browser, not automated browser control
数据库 NONE NONE — No database access
2 项发现
🔗
中危 外部 URL 外部 URL
https://getmembrane.com
SKILL.md:7
🔗
中危 外部 URL 外部 URL
https://plaid.com/docs/
SKILL.md:19

目录结构

1 文件 · 4.4 KB · 130 行
Markdown 1f · 130L
└─ 📝 SKILL.md Markdown 130L · 4.4 KB

依赖分析 1 项

包名版本来源已知漏洞备注
@membranehq/cli * npm 否 Version not pinned — installs latest on npm install

安全亮点

✓ All capabilities explicitly documented in SKILL.md — no hidden behavior
✓ Credential management delegated to Membrane's server-side auth lifecycle — no local secrets stored
✓ No credential harvesting, data exfiltration, or obfuscation observed
✓ No sensitive file paths (~/.ssh, ~/.aws, .env) accessed
✓ Uses pre-built Membrane actions rather than raw API calls, reducing attack surface
✓ MIT license and public repository listed for verification