中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 5/100
Last scan:1 day ago Rescan
5 /100
onespan
OneSpan integration for digital identity, e-signatures, and fraud prevention
This is a legitimate OneSpan integration skill that uses the Membrane CLI for API interaction. All behavior is clearly documented with no hidden functionality.
Skill Nameonespan
Duration21.0s
Enginepi
✓
Safe to install
No action required. This skill is safe to use as documented.

Findings 1 items

Severity Finding Location
Low
CLI tool installation without version pinning Supply Chain
The skill instructs users to install @membranehq/cli with @latest tag, which could install a different version over time
npm install -g @membranehq/cli
→ Consider pinning to a specific version for reproducible builds
 SKILL.md:18
ResourceDeclaredInferredStatusEvidence
Network READ READ ✓ Aligned SKILL.md: Uses membrane request for API proxy calls
Shell WRITE WRITE ✓ Aligned SKILL.md: Documents npm install and membrane CLI commands
2 findings
🔗
Medium External URL 外部 URL
https://getmembrane.com
SKILL.md:7
🔗
Medium External URL 外部 URL
https://developer.onespan.com/
SKILL.md:19

File Tree

1 files · 4.3 KB · 125 lines
Markdown 1f · 125L
└─ 📝 SKILL.md Markdown 125L · 4.3 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
@membranehq/cli latest npm No No version pinning - minor supply chain risk

Security Positives

✓ All shell commands are explicitly documented in SKILL.md
✓ Credential handling delegated to Membrane (no local secret storage)
✓ No base64 encoding, eval patterns, or obfuscation observed
✓ No sensitive file/path access patterns found
✓ Best practices documented (prefer built-in actions over raw API calls)
✓ No hidden functionality or shadow features detected