skills/membranedev/application-skills/shipworks/Socket

shipworks

Warn

Audited by Socket on Apr 29, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: The skill is broadly aligned with its stated ShipWorks integration purpose and uses an official-looking same-vendor CLI from npm, so it is not overtly malicious. The main concern is data-flow integrity: all authentication and API activity is routed through Membrane as a third-party intermediary, with mutable `@latest` installation and support for broad action execution/proxy requests that can have real operational effects.

Confidence: 83%Severity: 57%

Audit Metadata

Analyzed At

Apr 29, 2026, 05:41 PM

Package URL

pkg:socket/skills-sh/membranedev%2Fapplication-skills%2Fshipworks%2F@f20de13e7a771f118ccaadc5d2656864a4887a0f