中文 EN

扫描报告

扫描新文件

✓ 低风险 — 风险评分 10/100
上次扫描：1 天前 重新扫描
10 /100
tecalliance
TecAlliance integration for automotive data management
A legitimate TecAlliance API integration skill that uses the documented Membrane CLI for automotive data operations with no malicious code or hidden functionality.
技能名称tecalliance
分析耗时26.5s
引擎pi
✓
可以安装
Approve for use. The skill is well-documented and performs standard API integration through a legitimate third-party CLI tool.

安全发现 1 项

严重性 安全发现 位置
低危
Third-party CLI dependency 供应链
The skill depends on @membranehq/cli from npm. This is a legitimate, documented dependency but introduces supply chain risk if the package is compromised.
npm install -g @membranehq/cli
→ Verify package integrity and consider pinning to a specific version (e.g., @membranehq/[email protected]) rather than using latest
 SKILL.md:31
资源类型声明权限推断权限状态证据
文件系统 NONE WRITE ✓ 一致 npm install -g writes to global node_modules (implicit)
网络访问 READ READ ✓ 一致 membrane request for TecAlliance API calls
命令执行 NONE WRITE ✓ 一致 membrane CLI commands documented in SKILL.md
环境变量 NONE NONE — No environment variable access detected
技能调用 NONE NONE — No skill chaining detected
剪贴板 NONE NONE — No clipboard access detected
浏览器 NONE READ ✓ 一致 membrane login opens browser for OAuth authentication
数据库 NONE NONE — No database access detected
2 项发现
🔗
中危 外部 URL 外部 URL
https://getmembrane.com
SKILL.md:7
🔗
中危 外部 URL 外部 URL
https://developer.tecalliance.services/
SKILL.md:19

目录结构

1 文件 · 4.9 KB · 141 行
Markdown 1f · 141L
└─ 📝 SKILL.md Markdown 141L · 4.9 KB

依赖分析 1 项

包名版本来源已知漏洞备注
@membranehq/cli latest npm 否 Version not pinned - recommends using @latest

安全亮点

✓ No executable code present - only documentation
✓ No obfuscated or base64-encoded content
✓ No credential harvesting patterns detected
✓ All functionality clearly documented in SKILL.md
✓ Uses standard OAuth browser flow for authentication
✓ No access to sensitive system paths (~/.ssh, ~/.aws, etc.)
✓ No suspicious network patterns (no direct IP calls, no C2 indicators)
✓ Legitimate business use case (automotive data API integration)
✓ External URLs point to legitimate services (getmembrane.com, tecalliance.services)