Semgrep

• Analyzed: May 11, 2026, 1:22 AM
• Findings: 1
• Version: 1.0.2
• Hash: 829f8fa1ff782158653e02da7a84f7fd97b9807c32010396e0ca32ab48af1a2f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill requires the global installation of a third-party CLI (@membranehq/cli) and routes all Semgrep API interactions, including the retrieval of sensitive findings and secrets, through an external proxy service (Membrane). While these actions are documented in SKILL.md and aligned with the stated purpose, the requirement for global shell execution and the redirection of security data to a third-party intermediary constitute high-risk behaviors that increase the attack surface and supply chain risk.