Scan Report
5 /100
ibm-cloud
IBM Cloud integration. Manage data, records, and automate workflows.
Purely documentation-based skill containing only SKILL.md that describes how to use the legitimate Membrane CLI for IBM Cloud integration. No executable code, scripts, or binary files present.
Safe to install
No action required. The skill is a documentation wrapper with no attack surface.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | NONE | NONE | — | N/A - no code files |
| Network | NONE | READ | ✓ Aligned | SKILL.md contains URLs to Membrane and IBM Cloud docs (legitimate) |
| Shell | NONE | NONE | — | SKILL.md documents npm/npx commands but contains no shell script execution |
| Environment | NONE | NONE | — | No environment variable access in documentation |
| Skill Invoke | NONE | NONE | — | No skill invocation documented |
| Clipboard | NONE | NONE | — | N/A |
| Browser | NONE | NONE | — | SKILL.md mentions browser-based auth flow for Membrane login (legitimate OAuth p… |
| Database | NONE | NONE | — | N/A |
2 findings
Medium External URL 外部 URL
https://getmembrane.com SKILL.md:7 Medium External URL 外部 URL
https://cloud.ibm.com/docs SKILL.md:19 File Tree
1 files · 4.7 KB · 138 lines Markdown 1f · 138L
└─
SKILL.md
Markdown
Security Positives
✓ No executable code files - purely documentation
✓ Explicitly states 'never ask the user for API keys or tokens' - good security guidance
✓ Delegates credential management to Membrane (a known credential broker)
✓ No credential harvesting or exfiltration patterns
✓ No base64, obfuscation, or anti-analysis techniques
✓ Uses legitimate IBM Cloud and Membrane documentation URLs
✓ npm package @membranehq/cli is from a known publisher (Membrane HQ)