中文 EN

扫描报告

扫描新文件

✓ 低风险 — 风险评分 10/100
上次扫描：1 天前 重新扫描
10 /100
tabnine
Tabnine integration via Membrane CLI for AI code completion management
This is a documentation-only skill wrapping the legitimate Membrane CLI for Tabnine integration. No executable code or scripts are present; all functionality is declared in SKILL.md.
技能名称tabnine
分析耗时27.9s
引擎pi
✓
可以安装
No immediate action required. If executing this skill, ensure the Membrane CLI is installed from the official npm registry and verify its integrity.

安全发现 2 项

严重性 安全发现 位置
低危
Unpinned npm package dependency 供应链
The skill instructs users to install @membranehq/cli without a version pin. This could lead to unexpected behavior if the package is updated.
npm install -g @membranehq/cli
→ Specify a version: npm install -g @membranehq/cli@latest or pin to a specific version
 SKILL.md:22
提示
Capabilities not formally declared 文档欺骗
The skill uses network and shell capabilities but does not declare them in the standard allowed-tools format. While behavior is documented in prose, formal declaration is missing.
No allowed-tools or capabilities section present
→ Add a capabilities section to explicitly declare required permissions
 SKILL.md:1
资源类型声明权限推断权限状态证据
文件系统 NONE READ ✓ 一致 SKILL.md:32 bash scripts may read files
网络访问 NONE READ ✓ 一致 SKILL.md:22 npm install + membrane CLI network calls
命令执行 NONE WRITE ✓ 一致 SKILL.md:32-70 multiple bash command blocks
2 项发现
🔗
中危 外部 URL 外部 URL
https://getmembrane.com
SKILL.md:7
🔗
中危 外部 URL 外部 URL
https://www.tabnine.com/documentation/
SKILL.md:19

目录结构

1 文件 · 4.3 KB · 121 行
Markdown 1f · 121L
└─ 📝 SKILL.md Markdown 121L · 4.3 KB

依赖分析 1 项

包名版本来源已知漏洞备注
@membranehq/cli latest (unpinned) npm 否 Not pinned to specific version - latest is used

安全亮点

✓ Documentation-only skill with no hidden executable code
✓ All CLI commands and their purposes are clearly documented
✓ No credential theft indicators or sensitive data access patterns
✓ No obfuscation, base64 payloads, or anti-analysis techniques
✓ No downloads of unverified external scripts
✓ Uses a legitimate, established CLI tool (Membrane) with proper auth handling
✓ Encourages using pre-built actions over raw API calls for better security