footprint Security Report — Trusted | ClawSafe

5 /100

footprint

Footprint integration for sustainability management platform

Documentation-only skill for Footprint/Membrane CLI integration with all functionality properly declared and no malicious indicators.

Skill Namefootprint

Duration26.0s

Enginepi

✓

Safe to install

This skill is safe to use. The npm global install lacks version pinning, but this is acceptable for CLI tools and is declared in documentation.

Findings 1 items

Severity	Finding	Location
Low	npm global install without version pinning The SKILL.md instructs users to install @membranehq/cli globally without pinning to a specific version. `npm install -g @membranehq/cli` → Consider pinning to a major version (e.g., @membranehq/cli@latest) to avoid unexpected breaking changes, though this is standard practice for CLI tools.	`SKILL.md:43`

Resource	Declared	Inferred	Status	Evidence
Filesystem	`NONE`	`NONE`	—	No file operations in this documentation skill
Network	`READ`	`READ`	✓ Aligned	SKILL.md:80 - Uses membrane CLI to make API requests through Membrane proxy
Shell	`WRITE`	`WRITE`	✓ Aligned	SKILL.md:43 - Uses npm install and membrane CLI commands

2 findings

🔗

Medium External URL 外部 URL

https://getmembrane.com

SKILL.md:7

🔗

Medium External URL 外部 URL

https://usefootprint.com/docs

SKILL.md:19

1 files · 6.0 KB · 217 lines

Markdown 1f · 217L

└─ 📝 SKILL.md Markdown 217L · 6.0 KB

✓ Documentation-only skill with no executable code or scripts

✓ All shell and network operations are explicitly declared in SKILL.md

✓ No credential harvesting - explicitly instructs to use browser auth and connections

✓ No base64, eval, curl|bash, or other suspicious execution patterns

✓ No access to sensitive paths (~/.ssh, ~/.aws, .env)

✓ No hidden functionality or disguised behavior

✓ Uses legitimate Membrane platform for authentication (no direct API key handling)