shipp-sports-data
Warn
Audited by Socket on Sep 22, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS. The data-access portion is coherent and uses official Shipp endpoints, and the MoonPay CLI appears to be an official npm-distributed tool. However, the skill’s true footprint goes beyond sports data: it operationalizes autonomous, signal-driven financial trading, wallet funding, and off-ramping. That real-world action capability makes the skill high risk despite otherwise mostly legitimate install and data-flow patterns.
Confidence: 93%Severity: 79%
Audit Metadata