skills/mvanhorn/printing-press-library/pp-shipsgo/Socket

pp-shipsgo

Warn

Audited by Socket on Jul 20, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: The core purpose and API scope are coherent for a ShipsGo freight skill, and credential flow appears to target the official service. Risk comes from install trust mismatches (werkstoffclub skill pointing to mvanhorn-managed binaries), mutable installer paths, and an arbitrary webhook output sink that could exfiltrate shipment data.

Confidence: 84%Severity: 62%

Audit Metadata

Analyzed At

Jul 20, 2026, 11:01 PM

Package URL

pkg:socket/skills-sh/mvanhorn%2Fprinting-press-library%2Fpp-shipsgo%2F@abf5b81c32e78e47186cae3de03fab48c4e443926a7c5b7b1e4cd9320b7095dd