中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 20/100
Last scan:1 day ago Rescan
20 /100
function
Function integration for Membrane — manage Deals, Persons, Organizations, Leads, Projects, Pipelines via the Membrane CLI
Documentation-only skill that describes Membrane CLI integration for SaaS connections; no executable code present, all behaviors are declared in SKILL.md.
Skill Namefunction
Duration24.2s
Enginepi
✓
Safe to install
No immediate action required. Consider pinning the CLI version instead of using @latest to prevent unexpected behavior changes.

Findings 2 items

Severity Finding Location
Low
CLI uses @latest tag instead of pinned version Supply Chain
All npx commands use @membranehq/cli@latest which may fetch different versions over time, reducing reproducibility and introducing supply chain risk.
npx @membranehq/cli@latest login --tenant
→ Pin to a specific version (e.g., @1.2.3) instead of @latest to ensure consistent behavior.
 SKILL.md:35
Low
External URL points to unrelated documentation Doc Mismatch
The official docs link points to MathWorks MATLAB documentation (mathworks.com) instead of Membrane documentation. This is misleading for users seeking the actual API documentation.
https://www.mathworks.com/help/matlab/ref/function.html
→ Replace with the correct Membrane or Function API documentation URL.
 SKILL.md:17
ResourceDeclaredInferredStatusEvidence
Filesystem NONE READ ✓ Aligned SKILL.md mentions credential storage at ~/.membrane/credentials.json but no dire…
Network READ READ ✓ Aligned All network activity is through the documented Membrane CLI for API integration
Shell NONE READ ✓ Aligned SKILL.md describes npx CLI commands; no direct shell execution beyond the docume…
1 findings
🔗
Medium External URL 外部 URL
https://www.mathworks.com/help/matlab/ref/function.html
SKILL.md:17

File Tree

1 files · 4.5 KB · 115 lines
Markdown 1f · 115L
└─ 📝 SKILL.md Markdown 115L · 4.5 KB

Security Positives

✓ No executable code present in the skill — purely documentation
✓ All network operations are documented and routed through the Membrane CLI
✓ Credential management is delegated to the Membrane platform as documented
✓ No sensitive file access detected (no reading of ~/.ssh, ~/.aws, .env, etc.)
✓ No base64-encoded payloads, reverse shells, or obfuscated code
✓ No credential harvesting or data exfiltration patterns observed