扫描报告
0 /100
tutor-lms
Tutor LMS integration via Membrane CLI. Manage courses, students, and automate workflows.
This is a pure documentation-only skill with no executable code. All shell and network capabilities are explicitly declared in SKILL.md for interacting with the Membrane CLI.
可以安装
This skill is safe to use. No action required.
| 资源类型 | 声明权限 | 推断权限 | 状态 | 证据 |
|---|---|---|---|---|
| 文件系统 | NONE | NONE | — | No file operations in skill |
| 网络访问 | WRITE | WRITE | ✓ 一致 | SKILL.md declares 'network access' in compatibility; membrane request CLI comman… |
| 命令执行 | WRITE | WRITE | ✓ 一致 | SKILL.md declares npm install, membrane login, membrane connect, membrane action… |
| 环境变量 | NONE | NONE | — | No environment variable access described |
| 技能调用 | NONE | NONE | — | No skill invocation patterns found |
| 剪贴板 | NONE | NONE | — | No clipboard access |
| 浏览器 | NONE | NONE | — | Browser opens only for OAuth login flow, which is declared |
| 数据库 | NONE | NONE | — | No direct database access |
2 项发现
中危 外部 URL 外部 URL
https://getmembrane.com SKILL.md:7 中危 外部 URL 外部 URL
https://docs.themeum.com/tutor-lms/ SKILL.md:19 目录结构
1 文件 · 4.5 KB · 139 行 Markdown 1f · 139L
└─
SKILL.md
Markdown
安全亮点
✓ No executable code present — this is a documentation-only skill
✓ All shell commands (npm install, membrane CLI) are explicitly declared in SKILL.md
✓ Network access is declared in compatibility metadata
✓ No obfuscation, base64 encoding, or anti-analysis patterns
✓ No credential harvesting — credentials are handled server-side by Membrane
✓ No sensitive path access (~/.ssh, ~/.aws, .env)
✓ No dependencies or package files that could introduce supply chain risk
✓ Uses a legitimate third-party CLI (Membrane) for integration rather than raw credential handling
✓ Documentation clearly states to use Membrane for auth lifecycle instead of asking users for API keys