中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 15/100
Last scan:1 day ago Rescan
15 /100
lumigo
Lumigo integration skill for cloud observability platform interaction
This is a documentation-style skill that uses the Membrane CLI for Lumigo integration with no malicious behavior detected, though npm install lacks version pinning.
Skill Namelumigo
Duration31.9s
Enginepi
✓
Safe to install
Pin the CLI version to prevent unexpected updates: `npm install -g @membranehq/[email protected]`

Findings 2 items

Severity Finding Location
Low
Unpinned npm dependency Supply Chain
The @membranehq/cli package is installed without version pinning, allowing any version including potentially malicious ones to be installed.
npm install -g @membranehq/cli
→ Pin to a specific version: npm install -g @membranehq/cli@latest or a specific version number
 SKILL.md:25
Low
Network access not declared in capability requirements Doc Mismatch
The skill uses network access for Lumigo API interaction but this is not explicitly declared in the capability model.
Skill uses membrane proxy for API requests
→ Add network:READ to declared permissions if capability mapping is used
 SKILL.md:1
ResourceDeclaredInferredStatusEvidence
Shell READ WRITE ✓ Aligned SKILL.md:25 - npm install -g requires shell WRITE
Network NONE READ ✓ Aligned SKILL.md:45-80 - API requests through Membrane proxy
Filesystem NONE NONE — No filesystem operations declared or used
Environment NONE NONE — Membrane handles auth; no env var access
credential_theft NONE NONE — No credential harvesting; delegated to Membrane OAuth
2 findings
🔗
Medium External URL 外部 URL
https://getmembrane.com
SKILL.md:7
🔗
Medium External URL 外部 URL
https://lumigo.io/docs/
SKILL.md:19

File Tree

1 files · 4.6 KB · 135 lines
Markdown 1f · 135L
└─ 📝 SKILL.md Markdown 135L · 4.6 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
@membranehq/cli * npm No No version pinned - latest will be installed

Security Positives

✓ No credential harvesting or exfiltration detected
✓ No base64-encoded or obfuscated code
✓ No shell command injection vectors
✓ Authentication uses browser-based OAuth, not storing secrets locally
✓ Documentation accurately describes all functionality
✓ No direct API key or token handling by the skill
✓ Uses established Membrane platform for credential management