ship

Warn

Audited by Socket on Jun 19, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/ship-lib.ts

No clear malicious logic (no obfuscation, persistence, or network exfiltration) is evident in this module. The main security concerns are (1) the exported generic shell/command execution wrapper (command execution capability in consumers) and (2) adoToken() returning a raw Azure access token (high-sensitivity secret that could be mishandled downstream). Overall, malware likelihood appears low, but security risk is moderate due to sensitive credential handling and broad command-execution surface area.

Confidence: 66%Severity: 52%
Audit Metadata
Analyzed At
Jun 19, 2026, 01:46 PM
Package URL
pkg:socket/skills-sh/julianobarbosa%2Fclaude-code-skills%2Fship%2F@300dbcf62d211974a2baa18d604c0c84b6ab9d5e00e240fde2de4e87b82fe6d8
Security Audit — socket — ship