Scan Report
15 /100
snowflake
Snowflake integration for data warehousing and workflow automation
Legitimate Snowflake integration skill using the Membrane CLI with all capabilities properly documented; minor issue with unpinned npm package installation.
Safe to install
Skill is safe for use. Consider pinning the CLI version in install command for reproducibility (e.g., @membranehq/[email protected]).
Findings 1 items
| Severity | Finding | Location |
|---|---|---|
| Low | Unpinned npm package version Supply Chain | SKILL.md:27 |
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | NONE | NONE | — | No file operations detected |
| Network | READ | READ | ✓ Aligned | SKILL.md declares network access for Snowflake API via Membrane proxy |
| Shell | WRITE | WRITE | ✓ Aligned | SKILL.md declares npm install and membrane CLI usage (lines 27, 31, 42, etc.) |
| Environment | NONE | NONE | — | No environment variable access detected |
| Skill Invoke | NONE | NONE | — | No skill invocation detected |
| Clipboard | NONE | NONE | — | No clipboard access detected |
| Browser | NONE | NONE | — | No browser automation detected |
| Database | NONE | READ | ✓ Aligned | Snowflake database access is the core purpose and is declared in SKILL.md |
2 findings
Medium External URL 外部 URL
https://getmembrane.com SKILL.md:7 Medium External URL 外部 URL
https://docs.snowflake.com/en/ SKILL.md:19 File Tree
1 files · 4.3 KB · 126 lines Markdown 1f · 126L
└─
SKILL.md
Markdown
Dependencies 1 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
@membranehq/cli | latest | npm | No | Version not pinned |
Security Positives
✓ All shell commands (npm, membrane CLI) are explicitly documented in SKILL.md
✓ No credential handling - Membrane manages auth server-side with no local secrets
✓ No suspicious patterns detected (base64, eval, curl|bash, etc.)
✓ No sensitive path access (~/.ssh, ~/.aws, .env)
✓ Only one file exists (SKILL.md) with no hidden scripts or executables
✓ Uses legitimate, documented CLI toolchain
✓ No data exfiltration or C2 communication patterns