servicem8

Warn

Audited by Socket on May 2, 2026

1 alert found:

Anomaly
AnomalyLOW
SKILL.md

SUSPICIOUS: the skill’s purpose broadly matches ServiceM8 access, but the actual integration is mediated through Membrane rather than direct ServiceM8 APIs. That third-party routing is proportionate to the stated Membrane-based design, yet it expands trust and data exposure beyond a pure ServiceM8 skill. Install trust is moderate due to an official npm package, but use of an unpinned external CLI and intermediary platform keeps risk above benign.

Confidence: 85%Severity: 56%
Audit Metadata
Analyzed At
May 2, 2026, 02:49 PM
Package URL
pkg:socket/skills-sh/membranedev%2Fapplication-skills%2Fservicem8%2F@5bee62b38000b696fdd000afd3616ebd44fb066d