中文 EN

Scan Report

Scan New Files

✓ Low Risk — Risk Score 5/100
Last scan:23 hr ago Rescan
5 /100
getform
Getform integration. Manage data, records, and automate workflows.
Documentation-only skill that describes using the Membrane CLI to interact with Getform, with all functionality clearly declared and no hidden malicious behavior.
Skill Namegetform
Duration26.0s
Enginepi
✓
Safe to install
This skill is safe to use. When executing npm install -g, consider pinning to a specific version for reproducibility.

Findings 2 items

Severity Finding Location
Low
Unpinned npm package version Supply Chain
The skill instructs to install @membranehq/cli without specifying a version, which could lead to unexpected behavior if the package changes.
npm install -g @membranehq/cli
→ Consider pinning to a specific version: npm install -g @membranehq/[email protected]
 SKILL.md:27
Info
External URLs present Doc Mismatch
Skill references external URLs (getmembrane.com, getform.io) which is expected for a legitimate integration skill.
https://getmembrane.com
→ No action needed - external URLs are normal for integration documentation
 SKILL.md:7
ResourceDeclaredInferredStatusEvidence
Filesystem NONE NONE — No file operations in SKILL.md
Network READ READ ✓ Aligned Uses Membrane CLI for API requests to Getform
Shell WRITE WRITE ✓ Aligned Uses npm install -g and membrane CLI commands (documented)
Environment NONE NONE — No environment variable access documented
2 findings
🔗
Medium External URL 外部 URL
https://getmembrane.com
SKILL.md:7
🔗
Medium External URL 外部 URL
https://getform.io/docs
SKILL.md:19

File Tree

1 files · 4.3 KB · 122 lines
Markdown 1f · 122L
└─ 📝 SKILL.md Markdown 122L · 4.3 KB

Security Positives

✓ No executable code - documentation only
✓ All shell commands and network access clearly declared in SKILL.md
✓ Credentials managed through Membrane's secure connection system, not local API keys
✓ No access to sensitive files (~/.ssh, ~/.aws, .env)
✓ No obfuscation or base64-encoded content
✓ No credential harvesting behavior
✓ Standard legitimate integration documentation