shipp-sports-data

Warn

Audited by Socket on Sep 22, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The data-access portion is coherent and uses official Shipp endpoints, and the MoonPay CLI appears to be an official npm-distributed tool. However, the skill’s true footprint goes beyond sports data: it operationalizes autonomous, signal-driven financial trading, wallet funding, and off-ramping. That real-world action capability makes the skill high risk despite otherwise mostly legitimate install and data-flow patterns.

Confidence: 93%Severity: 79%
Audit Metadata
Analyzed At
Sep 22, 2026, 05:11 PM
Package URL
pkg:socket/skills-sh/moonpay%2Fskills%2Fshipp-sports-data%2F@4495c8c7de44ee6eaa4ca190a002d209d2f2c4aec322539f133e6dfbef5814bb