Low Risk — Risk Score 5/100
Last scan:1 day ago Rescan
5 /100
actindo
Actindo integration for ERP management - product, order, and workflow automation
Legitimate Actindo ERP integration skill using the Membrane CLI for API proxying and OAuth authentication delegation. No malicious behavior detected.
Skill Nameactindo
Duration32.7s
Enginepi
Safe to install
This skill is safe to use. The only minor improvement would be pinning the CLI version (e.g., @membranehq/[email protected]) to ensure reproducibility.

Findings 1 items

Severity Finding Location
Low
CLI version not pinned Supply Chain
The Membrane CLI is installed via `npm install -g @membranehq/cli` without specifying a version, which could lead to unexpected behavior if the package is updated.
npm install -g @membranehq/cli
→ Consider pinning to a specific version: npm install -g @membranehq/[email protected]
SKILL.md:32
ResourceDeclaredInferredStatusEvidence
Filesystem NONE NONE No file operations observed
Network READ+WRITE READ+WRITE ✓ Aligned SKILL.md:47 - Uses membrane request for API calls
Shell WRITE WRITE ✓ Aligned SKILL.md:32 - npm install -g and membrane commands
Environment NONE NONE No direct environment access; credentials handled by Membrane
Skill Invoke NONE NONE No cross-skill invocation
Clipboard NONE NONE No clipboard access
Browser NONE NONE Browser auth delegated to Membrane
Database NONE NONE No direct database access
2 findings
🔗
Medium External URL 外部 URL
https://getmembrane.com
SKILL.md:7
🔗
Medium External URL 外部 URL
https://dev.actindo.com/
SKILL.md:19

File Tree

1 files · 4.8 KB · 150 lines
Markdown 1f · 150L
└─ 📝 SKILL.md Markdown 150L · 4.8 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
@membranehq/cli * npm No Version not pinned

Security Positives

✓ Documentation is clear and describes all functionality accurately
✓ Credentials are delegated to Membrane (trusted auth provider) - no local credential storage
✓ No credential harvesting or exfiltration observed
✓ No obfuscated code, base64 execution, or suspicious patterns
✓ No access to sensitive paths (~/.ssh, ~/.aws, .env)
✓ No hidden functionality or doc-to-code mismatch
✓ Standard npm CLI tool from a known publisher